Server Details
Doormat Capital's paid x402 safety tools (token scan, HTTP security headers) for AI agents.
- Status
- Healthy
- Uptime
- 100.0% over 25 days
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-06-18
- URL
- ChatGPT
- –
- Claude
- –
TDQS
Scored across 4 tools
Each tool targets a distinct inspection target: Base ERC-20 token safety (apecheck_report), robots.txt AI-crawler policy (crawlercheck_check), llms.txt presence (llmstxt_check), and HTTP security headers (secheaders_report). There is no overlap in purpose or trigger conditions, and the paid/free distinction further separates them.
All four follow a <domain>_<output> snake_case pattern, with _report consistently denoting the paid tools and _check the free ones. The main blemish is the redundant 'crawlercheck_check', which slightly breaks the otherwise clean scheme.
Four tools is on the small side but each is clearly scoped to a separate check, so nothing feels padded or missing. It is lean for what could be a broader web/AI-readiness auditing suite, but appropriate for a focused checker.
The set covers the main 'is this site/token safe for AI agents' checks: crawler policy, llms.txt, security headers, and token contract safety, each with a coherent payment lifecycle via x402. Some adjacent checks (e.g. TLS/DNS or terms/structured-data) are absent, but core workflows have no dead ends.
Available Tools
4 toolsapecheck_reportAInspect
Paid (x402, USDC on Base). Full safety report for a Base ERC-20 token contract: metadata, raw owner address, mint-selector heuristic, approximate recent-activity signal. Call without 'tx' first to receive the exact x402 payment challenge (amount, asset, payTo address, chain); pay that amount in USDC on Base, then call again with the resulting transaction hash in 'tx' to receive the real report.
| Name | Required | Description | Default |
|---|---|---|---|
| tx | No | Optional: 0x-prefixed 64-hex-character Base transaction hash proving payment. Omit on the first call to see the payment challenge. | |
| address | Yes | 0x-prefixed 40-hex-character Base token contract address. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses the paid x402/USDC-on-Base model, the exact two-phase challenge/pay/retry flow, and the fields the report returns. It stops short of error handling, refund/failure behavior, or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the cost/payment model before the report contents and the invocation sequence. Dense but every clause carries information; no padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, and the description compensates by naming the report's fields and the payment mechanics. A deficiency remains around failure modes (e.g., what happens with an invalid or already-used tx hash) for a paid tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both 'tx' and 'address' are already documented with format requirements. The description restates the 'omit tx on first call' semantics, which is useful framing but adds little beyond the schema; baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Full safety report for a Base ERC-20 token contract') and enumerates the report contents (metadata, owner address, mint-selector heuristic, activity signal). However, it never mentions the sibling secheaders_report, so an agent cannot tell from this text alone which report to pick.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear procedural guidance: call without 'tx' first to receive the x402 challenge, pay in USDC on Base, then call again with the transaction hash. It does not state when this tool is preferable to secheaders_report, so alternative-selection guidance is absent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
crawlercheck_checkBInspect
FREE, no payment required. Checks a site's robots.txt against a list of known AI crawlers (GPTBot, ClaudeBot, Google-Extended, etc.) and reports which are allowed or blocked.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | The site URL to check (e.g. https://example.com). robots.txt is looked up at that domain's root. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It helpfully discloses the result shape ('reports which are allowed or blocked') and a cost signal ('FREE, no payment required'), but says nothing about read-only safety, network/latency behavior, robots.txt fetch failures, or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with the cost/access fact front-loaded and the core behavior second. Every clause earns its place and nothing is buried or repeated.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter, no-output-schema tool, the description explains both what it does and what it returns ('allowed or blocked'), which is enough for correct invocation. It could mention the sibling tools or failure behavior, but nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is a single parameter with 100% schema description coverage, and the schema already explains the URL format and that robots.txt is looked up at the domain root. The description adds no syntax or format detail beyond that, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Checks') and resource ('a site's robots.txt against a list of known AI crawlers') and names concrete crawlers, so an agent can tell this apart from the llms.txt, security-headers, and APE-check siblings by resource. It does not explicitly name those siblings, but the resource is distinctive enough that differentiation is mostly achieved.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no exclusions, and no mention of the alternative sibling tools (llmstxt_check, secheaders_report, apecheck_report). Usage is only implied by the tool's purpose, leaving the agent to infer when this check is appropriate versus the other checks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
llmstxt_checkAInspect
FREE, no payment required. Checks whether a site has a valid llms.txt file (the emerging convention for telling AI crawlers/agents what a site is and how to use it): fetches it, reports status and any errors/warnings.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | The site URL to check (e.g. https://example.com). llms.txt is looked up at that domain's root. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does disclose useful traits: it performs a network fetch, is free, and returns status plus errors/warnings. It does not state that the operation is read-only, whether it is rate-limited, how long the fetch takes, or what happens on network failure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The cost qualifier is front-loaded and the purpose follows immediately in a single, dense sentence. The parenthetical explanation of llms.txt is slightly long but earns its place by grounding an emerging convention the agent may not know.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter read-only check with no output schema and no annotations, the description covers the essentials: what it fetches, that it is free, and the shape of what comes back (status and errors/warnings). Remaining gaps (latency, read-only confirmation) are minor for a tool this simple.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter, and schema coverage is 100% — the schema already explains that llms.txt is looked up at the domain root of the given URL. The description adds no format or edge-case detail beyond that, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (checks), a specific resource (a site's llms.txt file), and the exact procedure (fetch it, report status and errors/warnings). It also explains what llms.txt is, so an agent unfamiliar with the convention can tell this apart from the unrelated sibling checks (apecheck_report, crawlercheck_check, secheaders_report).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the purpose (verify a site's llms.txt validity), but there is no explicit when-to-use guidance, no prerequisites, and no mention of when a sibling check would be the better choice. 'FREE, no payment required' is a pricing signal, not usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
secheaders_reportAInspect
Paid (x402, USDC on Base). Full HTTP security-headers report for a URL: every header checked, raw values, remediation detail. Call without 'tx' first to receive the exact x402 payment challenge; pay, then call again with the transaction hash in 'tx' to receive the full report.
| Name | Required | Description | Default |
|---|---|---|---|
| tx | No | Optional: 0x-prefixed 64-hex-character Base transaction hash proving payment. Omit on the first call to see the payment challenge. | |
| url | Yes | The URL to check (e.g. https://example.com). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses the tool is paid, the payment rail (x402, USDC on Base), and the required two-call handshake with a transaction hash. It omits failure/expiry behavior for the challenge and any rate or latency expectations, so it stops short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero filler, with the paid/two-step constraint front-loaded before the report contents. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No annotations and no output schema, yet the description supplies both the cost/payment mechanics and a summary of what the report returns, which is exactly what an agent needs to invoke this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both 'url' and 'tx' are already documented in the schema, including the 'omit on first call' semantics. The description reinforces the tx flow but adds no new syntax, format, or constraint beyond the schema. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('Full HTTP security-headers report for a URL') and enumerates the payload contents (every header checked, raw values, remediation detail). It does not differentiate from the sibling apecheck_report, so it cannot earn a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives an explicit operating procedure: call without 'tx' first to get the x402 payment challenge, pay, then call again with the transaction hash. That is clear when-to-use guidance for this tool, though no alternative/sibling routing or exclusion criteria is offered.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
- Added
crawlercheck_check - Added
llmstxt_check
2 tool updates
- First observed
apecheck_report - First observed
secheaders_report
Related MCP Connectors
Pay-per-call safety checks for AI agents: screen a crypto address or URL before you transact.
Token rug-risk scans, Know Your Agent wallet checks and deployer reputation for AI agents.
Pay-per-call safety guards for AI agents: injection, tool-call, signing, secret, x402-trust.
Free token-safety scans + paid x402 verdicts, signals, radar & EVM swap quotes for AI agents.
Related MCP Servers
- AlicenseAqualityDmaintenancesecurity tools for AI agents: URL safety scanning, prompt injection detection (200+ patterns), email/password breach checks via HIBP, domain & IP reputation analysis, and AI skill supply chain scanning. Free tier (3 calls/day) or pay-per-request with USDC micropayments via x402.93 npm1MIT
- AlicenseNot gradedqualityCmaintenanceEnables AI agents to run paid safety and data pre-checks over streamable HTTP — Base token risk and pricing, wallet balances and screening, transaction decoding, calldata and EIP-712 signature checks, ENS resolution, DNS/WHOIS, link phishing and security-header audits — with each tool call settled by an x402 USDC micropayment on Base instead of an account or API key. Also offers x402 seller preflight and web content extraction.MIT
- AlicenseNot gradedqualityFmaintenanceArchived and no longer maintained. Tools and prices shown here are out of date. Use the maintained server: glama.ai/mcp/servers/OceanAlt666/oceanalt-aml-mcp (GitHub: OceanAlt666/oceanalt-aml-mcp).115 npmMIT
- AlicenseNot gradedqualityBmaintenanceInput/output safety gate for AI agents: detect prompt-injection/jailbreak, leaked secrets/PII, and URL/IP reputation. Deterministic, no LLM.427 npm1MIT
Glama MCP Gateway
Add one secure layer between your agents and this server.