ScorpTech MCP server

• Registry namecom.it.scorptech/x402verified in the MCP registry

The registry name sits under scorptech.it.com. The registry only lets a publisher use that namespace after proving control of the domain through DNS or HTTP.

• Stateanswerschecked 2026-10-29
• Tools1012
• Server calls itselfscorptech-x402
• Server version1.0.0
• Protocol version2025-06-18

On 2026-10-29 the server answered initialize and tools/list without a sign-in. First answer in 220 ms.

• Its tools do none of the product's use cases we checked: Set up online booking and automatic quote reminders; Automate invoicing, follow-ups, and scheduling reminders.
• Checked on 5 of the 7 days it takes to judge reliability.

Said by rules from the measurements above. The likely first call is a model's pick from the tool list; read its description before relying on it.

• INITE MCP scoreafter a weeka score needs 7 daily checks: 5 so far
• What an agent can do with it0 of 2 use cases
• Answeredmeasuring5 of the 7 daily checks it takes to print a share
• Median first answer226 ms
• Space in an agent's context≈ 89,447 tokensthe definitions of all its tools (400), which an agent carries on every turn
• Tool definitionsB · 89 of 100
• Typed results0 of 400 toolsdeclared outputSchema: results come typed, read once

• Parameters without a type: in 8 of 400
• Parameters without a description: in 247 of 400

A program checks the server once a day: initialize and tools/list, no model. Tokens are the definitions' length at about four characters a token. The grade averages six checks of every tool's name, description, schema and annotations; it says how well the tools are described, not whether they work. The score weighs what was measured and nothing else: answering (25%), doing the product's job (25%), definitions (20%), context (10%), use (10%) and how readily a client connects (10%). A part that was not measured is left out, and a hidden instruction caps the score at 40. The state of vendors' MCP servers: method and numbers →

• headers_audit

  Graded HTTP security-header audit of a URL: HSTS, CSP quality, XFO, nosniff, Referrer/Permissions/COOP/CORP/COEP, cookie flags, redirect chain, server info leaks, with fix recommendations. Price: $0.005 USDC per successful call (x402…

• email_auth

  Email authentication & deliverability posture for a domain: SPF (qualifier, lookup count, duplicates), DMARC policy/rua/pct, DKIM probe across common selectors, MTA-STS, TLS-RPT, BIMI, MX; scored with actionable issues. Useful for…

• domain_intel

  One-call domain due-diligence: RDAP registration age/expiry/registrar, A/AAAA/NS/MX/CAA, live TLS certificate (issuer, expiry, SANs, trust), Certificate-Transparency subdomain enumeration, and risk flags (new domain, expiring cert, no…

• robots_sitemap

  Fetch and parse robots.txt plus discovered sitemaps for a domain: user-agents, allow/disallow samples, sitemap index vs urlset, URL counts and sample locs. Useful for crawl planning and AI agent politeness checks. Price: $0.005 USDC per…

• tech_stack

  Lightweight technology fingerprint from public HTML/headers: CMS, frameworks (Next/Nuxt/React/Vue), CDNs, analytics, payments, generator meta, script/stylesheet samples. No invasive probing. Price: $0.005 USDC per successful call (x402…

• rdap_age

  Lightweight RDAP registration age lookup: registered/expiry dates, ageDays, daysToExpiry, registrar, status flags via rdap.org bootstrap. Faster/cheaper than full domain-intel when you only need age. Price: $0.005 USDC per successful call…

• phishing_score

  Heuristic phishing-likelihood score for a URL/domain: brand typosquat distance, subdomain depth, punycode, RDAP age, HTTPS reachability. Returns scored signals — not a verdict. Low Bazaar crowding. Price: $0.008 USDC per successful call…

• cve_lookup

  Search NIST NVD CVE API 2.0 by product/keyword with optional CVSSv3 severity filter. Returns CVE ids, scores, vectors, descriptions and reference URLs. Public NVD data. Price: $0.01 USDC per successful call (x402, Solana). Same tool over…

• package_risk

  npm or PyPI package risk/typosquat check: registry metadata, weekly downloads (npm), deprecation, license/repo presence, edit-distance to popular packages, and whether close-name variants already exist. Heuristic — not a malware scanner…

• github_health

  GitHub repository health summary via public API: stars/forks/issues, license, languages, last push age, latest release & commit, heuristic healthScore and notes. Unauthenticated rate limits apply. Price: $0.008 USDC per successful call…

• opengraph

  Extract Open Graph, Twitter Card, title/description, canonical, icons and JSON-LD @types from a public URL. Ideal for link unfurling agents. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET…

• url_markdown

  Fetch a public HTML page and convert main/article content to Markdown (Turndown). Scripts/styles stripped; output capped. Good for RAG/agent ingestion. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET…

• schema_validate

  Validate JSON data against a JSON Schema (Ajv + formats). Body: { "schema": {...}, "data": {...} }. Returns valid boolean and error list. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: POST…

• mx_check

  MX / mail-routing check: sorted MX with inferred provider (Google, M365, Proofpoint, etc.), A/AAAA, SPF presence, null-MX detection. Complements /v1/email-auth. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS…

• ip_intel

  IP ASN + geolocation from free public sources (ipapi.co + RIPE Stat prefix-overview). Country/city/coords, ASN/org, announced prefix. Public IPs only. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET…

• solana_tx

  Decode a Solana mainnet transaction via public RPC: status, fee, compute units, parsed instructions, inner instructions, account keys, logs. No API key. Unique on Bazaar. Price: $0.005 USDC per successful call (x402, Solana). Same tool…

• wayback

  Check Internet Archive Wayback Machine availability for a URL (closest snapshot timestamp + archived URL). Public availability API. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET…

• dns_dump

  All common DNS records for a domain via Cloudflare DNS-over-HTTPS: A, AAAA, NS, MX, TXT, CAA. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/dns-dump

• ct_subdomains

  Certificate Transparency subdomain enumeration via crt.sh JSON API. Returns unique hostnames (capped) issued under the domain. Price: $0.008 USDC per successful call (x402, Solana). Same tool over HTTPS: GET…

• redirect_chain

  Follow HTTP redirects (max 10) with SSRF protections; report each hop status, Location, Server and Content-Type. Detect open-redirect chains and tracking bounces. Price: $0.005 USDC per successful call (x402, Solana). Same tool over…

• http_probe

  Fast HTTP GET probe: final URL, status, timing, response bytes, and a subset of interesting headers (server, cache, HSTS, CDN). Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET…

• x402_probe

  x402 preflight for AI agents: inspect any paid endpoint BEFORE paying. Fetches the unpaid 402, decodes PAYMENT-REQUIRED (v2 header or v1 body), normalises price to USD, lists networks/assets/payTo/feePayer, validates the offer and Bazaar…

• web_to_text

  Fetch a public web page and return its main content as clean plain text (boilerplate stripped, lists as bullets, tables tab-separated) plus title, description, language, word count. Price: $0.005 USDC per successful call (x402, Solana)…

• url_links_extract

  Extract every link on a page as absolute URLs (RFC 3986 resolution, <base href> aware), classified internal/external/other with anchor text, rel and nofollow. Options: filter, dedupe, max_links. Price: $0.005 USDC per successful call…

• qr_generate

  Generate a QR code (PNG or SVG, base64 + data URI) for any UTF-8 text up to 2953 bytes. Options: ecc L|M|Q|H, size (px/module), margin, format png|svg, fg/bg hex colours. Price: $0.005 USDC per successful call (x402, Solana). Same tool…

• text_stats

  Text statistics: characters, words, unique words, sentences, paragraphs, reading/speaking time, Flesch readability (English), language detection (27 languages/scripts), top keywords. Price: $0.005 USDC per successful call (x402, Solana)…

• html_to_markdown

  Convert an HTML string to clean Markdown (GFM tables, fenced code, nested lists). No fetch. Body: { "html": "...", "base_url"?: "https://...", "extract_main"?: false }. Price: $0.005 USDC per successful call (x402, Solana). Same tool over…

• image_info

  Inspect an image without decoding pixels: format, dimensions (EXIF-orientation aware), megapixels, animation, sha256, EXIF summary (camera, exposure, GPS). Body: { "image": "<base64>" }. Max ~190KB input image (the service caps POST…

• image_resize

  Resize / convert an image (GD): width/height up to 4096, fit contain|cover|fill|inside, output png|jpeg|webp|gif, quality, EXIF auto-orient, metadata stripped. Body: { "image": "<base64>", "width": 256 }. Max ~190KB input image (the…

• sec_edgar_search

  SEC EDGAR filings search: latest 10-K/10-Q/8-K (or any form) for a company by name, ticker or CIK, with direct document and filing-index links; or full-text search across all EDGAR filings since 2001 (?q=), optionally scoped to one…

• sec_form4

  Insider trading from SEC Form 4: the latest Form 4 filings for a ticker or CIK parsed from EDGAR ownershipDocument XML. Reporting owner and role, every transaction (code + meaning, shares, price, value, acquired/disposed, holdings after…

• company_profile

  Company profile from its own website: name, description, logo, social profiles, contact emails/phones, postal address, schema.org Organization JSON-LD, OpenGraph/Twitter cards, plus RDAP domain registration basics (registered, expires…

• weather_nws

  US weather from the National Weather Service for a latitude/longitude: 7-day (or hourly) forecast periods with temperature, precipitation chance, wind and text forecast, plus all active NWS watches, warnings and advisories for that point…

• arxiv_search

  Search arXiv papers: title, authors, full abstract, categories, dates, DOI/journal ref and direct abs + PDF links. Plain keywords or arXiv field syntax (ti:, au:, abs:, cat:, AND/OR), optional category filter and sort by relevance or…

• earthquakes

  Recent earthquakes from the USGS: filter by bounding box or center point + radius, minimum magnitude and time window (last N days or start/end dates). Returns magnitude, place, time, coordinates, depth, tsunami flag, PAGER alert, felt…

• holidays_business_days

  Public holidays for 100+ countries (optionally one state/region) and business-day math in one call: list holidays for a year, add or subtract N business days, check if a date is a business day, or count business days between two dates…

• hn_search

  Search Hacker News stories and comments (Algolia HN index): by relevance or newest first, with date range, story/comment/Ask HN/Show HN filter, author and minimum points. Returns title, URL, points, comment count, author, time, comment…

• dns_propagation

  DNS propagation check: resolves one record type for a domain across Cloudflare 1.1.1.1, Google 8.8.8.8 and Quad9 9.9.9.9 (DNS-over-HTTPS, in parallel) and reports consensus, per-resolver answers, TTLs, rcodes and differences. Price: $0.01…

• ssl_cert_info

  Inspect a live TLS certificate: subject, issuer, SANs, validity window, days to expiry, SHA-256 fingerprint, key type/size, full presented chain, negotiated TLS version/cipher, chain trust and RFC 6125 hostname match. Implicit-TLS ports…

• email_validate

  Validate an email address without sending mail: RFC 5321/5322 syntax, MX/A lookup (null-MX aware), disposable-domain detection (~10k domains), role-account and free-provider flags, typo suggestion (gmial.com -> gmail.com), overall…

• password_strength

  Offline password strength audit (POST only, so the password never appears in a URL or access log; never echoed or stored): zxcvbn-style score 0-4, estimated guesses and entropy, crack-time estimates, weak patterns (common/breached…

• validate_batch

  Offline format validator for up to 100 values: email, URL, IPv4/IPv6, domain, UUID (version/variant), credit card (Luhn + brand, number masked in output), IBAN (mod-97 + country length), phone (E.164), JSON, base64/base64url. POST JSON…

• sol_balance

  SOL and SPL token balances (classic SPL Token + Token-2022) for a Solana wallet address, via public Solana RPC. Read-only. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET…

• sol_token_meta

  Solana SPL / Token-2022 mint metadata: decimals, total supply, mint & freeze authority, Token-2022 extensions, and name/symbol/uri from on-chain metadata (Token-2022 or Metaplex), with Jupiter token list fallback. Read-only. Price: $0.005…

• sol_token_risk

  Heuristic risk screen for a Solana token mint: mint/freeze authority, Token-2022 extensions (permanent delegate, transfer hook/fee, default-frozen, pausable...), metadata mutability, holder concentration, DEX liquidity and pair age…

• evm_balance

  Native ETH and ERC-20 token balances for an address on Ethereum, Base or Arbitrum via public RPC. Defaults to major tokens (USDC, USDT, WETH, DAI/ARB) or pass up to 20 token contracts. Read-only. Price: $0.005 USDC per successful call…

• evm_tx_info

  Decode an EVM transaction (Ethereum, Base, Arbitrum): status, block, timestamp, confirmations, from/to, value, gas used, effective gas price, fee, method selector name, and decoded ERC-20 Transfer/Approval events. Read-only, public RPC…

• fx_rate

  Fiat currency exchange rate (ECB reference rates via Frankfurter, with ExchangeRate-API fallback for 150+ currencies), optional amount conversion and historical date. Read-only. Price: $0.005 USDC per successful call (x402, Solana). Same…

• ens_resolve

  Resolve an ENS name to its Ethereum address (plus optional text records like avatar, url, com.twitter), or reverse-resolve an address to its forward-verified primary ENS name. Read-only, public RPC. Price: $0.005 USDC per successful call…

• geocode

  Geocode an address or place name to latitude/longitude (US Census Geocoder for US street addresses, Photon/OpenStreetMap worldwide), or reverse-geocode lat/lon to an address (with US county/tract). Read-only. Price: $0.005 USDC per…

• wallet_risk_basic

  Basic heuristic risk screen for a Solana or EVM (Ethereum/Base/Arbitrum) wallet: activity & age, bundled OFAC-SDN / mixer list matches for the address and recent counterparties, and (EVM) live token-approval exposure (unlimited…

• sanctions_screen

  Sanctions screening of a person or company NAME against the official consolidated lists: US OFAC SDN + non-SDN, UK Sanctions List (FCDO/OFSI), EU Financial Sanctions Files and the UN Security Council Consolidated List, loaded from the…

• sec_13f

  Institutional holdings from a fund manager's latest SEC 13F-HR: the information table parsed from EDGAR, aggregated by CUSIP (issuer, class, shares, USD value, portfolio weight, put/call, voting authority), with filing period, totals…

• treasury_rates

  US Treasury rates: the daily par yield curve (1M-30Y, from treasury.gov) with day-over-day change in bp, 2s10s spread and 3m10y inversion flag, optional TIPS real yield curve, plus Debt to the Penny (total public debt, debt held by the…

• domain_availability

  Bulk domain availability: for up to 20 domains, asks the authoritative registry over RDAP (server chosen from the IANA RDAP bootstrap). RDAP 404 = available; registered names return registrar, IANA id, creation/expiry dates, status and…

• eu_vat_validate

  Validate an EU VAT number live against the European Commission VIES service: valid/invalid, plus registered trader name and address where the member state discloses them. Accepts IE6388047V style input or ?country= + number; GR is mapped…

• ip_reputation

  IP blocklist reputation for up to 50 IPv4/IPv6 addresses: membership in the Tor exit list, Spamhaus DROP/DROPv6, abuse.ch Feodo Tracker botnet C2 and FireHOL level1 (cached published lists), with matched range/SBL reference, categories…

• cisa_kev

  CISA Known Exploited Vulnerabilities check: is a CVE (or up to 100) in CISA's KEV catalog, with date added, federal remediation due date, past-due flag, known ransomware use, required action and CWEs. Or search the catalog by…

• epss_score

  FIRST EPSS exploit-prediction scores for up to 100 CVEs: probability of exploitation in the next 30 days, percentile rank and a simple band, for the latest model run or a past date. Complements /v1/cve-lookup and /v1/cisa-kev for…

• hsts_preload

  HSTS preload check for a domain: current status on the Chromium preload list (hstspreload.org), the official preloadable errors/warnings, and our own live checks of the site's HSTS header (max-age >= 1 year, includeSubDomains, preload…

The first 60 of 1012, as the server listed them.