Which integrations are available for this server?

Provides tools for querying native token balances, ERC20 tokens, and transaction details, alongside security assessments for wallets and smart contracts. Enables scraping of Google search results (SERP), including snippets and related searches, and retrieving autocomplete keyword suggestions. Provides the capability to generate website screenshots in JPEG format. Converts web pages and HTML content into clean, structured Markdown with support for headings, lists, and tables. Supports native token balance checks and transaction queries on the Optimism blockchain. Allows for native token balance and transaction data retrieval on the Polygon network. Integrates VirusTotal for phishing and malware detection during URL scans and for comprehensive threat intelligence lookups.

MCP Services

Multi-tool MCP server + REST API for AI agents. 29 tools across web scraping, SEO analysis, agent memory, screenshot/PDF generation, domain intelligence, content extraction, multi-chain EVM blockchain queries, and security toolkit.

Live: mcp.skills.ws | Docs: llms.txt | npm: npm install -g mcp-services

Quick Start

Use the hosted version (no setup)

Add to your MCP client config (Claude Desktop, Cursor, OpenClaw, etc.):

{
  "mcpServers": {
    "mcp-services": {
      "url": "https://mcp.skills.ws/mcp/sse"
    }
  }
}

Free tier: 10 calls/day, no auth needed.

Self-host

npm install -g mcp-services
mcp-services
# -> running on http://localhost:3100

Tools (29)

Web Scraping

Tool	Endpoint	Description
`scrape`	`GET /api/scrape`	URL to clean Markdown with headings, lists, links, code blocks, tables
`crawl`	`GET /api/crawl`	Crawl a site from starting URL, follow internal links (depth 1-3, max 20 pages)
`extract`	`GET /api/extract`	Extract structured data: JSON-LD, Open Graph, meta tags, headings, links, images, tables

SEO Toolkit

Tool	Endpoint	Description
`serp`	`GET /api/serp`	Google SERP scraping -- top 20 results, People Also Ask, featured snippets, related searches
`onpage_seo`	`GET /api/onpage-seo`	Full on-page SEO audit with score (0-100) -- title, meta, headings, images, schema, Open Graph
`keywords_suggest`	`GET /api/keywords`	Google Autocomplete keyword suggestions with A-Z expansion (100+ ideas)

Agent Memory

Tool	Endpoint	Description
`memory_store`	`POST /api/memory`	Store a memory (key-value, namespace-scoped, with tags). Upserts on key conflict
`memory_get`	`GET /api/memory`	Retrieve a memory by namespace + key
`memory_search`	`GET /api/memory/search`	Full-text search across memories in a namespace
`memory_list`	`GET /api/memory/list`	List all memories in a namespace with pagination
`memory_delete`	`DELETE /api/memory`	Delete a memory by namespace + key

Screenshot & PDF

Tool	Endpoint	Description
`screenshot`	`GET /api/screenshot`	PNG/JPEG screenshot of any URL
`pdf`	`GET /api/pdf`	Generate PDF of any URL
`pdf2docx`	`GET /api/pdf2docx`	Convert PDF (from URL) to Word/DOCX -- text extraction with heading detection

Content Extraction

Tool	Endpoint	Description
`html2md`	`GET /api/html2md`	Fetch URL, strip nav/ads/scripts, convert to Markdown
`ocr`	`GET /api/ocr`	Extract text from image URL via Tesseract.js OCR

Domain Intelligence

Tool	Endpoint	Description
`whois`	`GET /api/whois`	WHOIS registrar, creation date, expiry, name servers
`dns`	`GET /api/dns`	DNS records -- `A`, `AAAA`, `MX`, `NS`, `TXT`, `CNAME`, `SOA`, or `ALL`
`ssl`	`GET /api/ssl`	SSL certificate issuer, validity dates, expiry countdown, fingerprint

Blockchain (6 EVM chains)

Tool	Endpoint	Description
`balance`	`GET /api/chain/balance`	Native token balance for any address
`erc20_balance`	`GET /api/chain/erc20`	ERC20 token balance, symbol, decimals
`transaction`	`GET /api/chain/tx`	Transaction details -- from, to, value, gas, status

Supported chains: Ethereum, Base, Arbitrum, Optimism, Polygon, Celo

Security Toolkit

Tool	Endpoint	Description
`url_scan`	`GET /api/security/url-scan`	Phishing & malware detection -- VirusTotal + heuristics (typosquatting, homoglyphs, suspicious TLDs, free hosting)
`wallet_check`	`GET /api/security/wallet-check`	Ethereum wallet risk assessment -- Etherscan verification, tx patterns, OFAC sanctions, address poisoning warnings
`contract_scan`	`GET /api/security/contract-scan`	Smart contract honeypot & risk detection -- Honeypot.is + source code analysis (mint, blacklist, fee manipulation, proxy)
`email_headers`	`GET /api/security/email-headers`	Email authentication check -- SPF, DKIM, DMARC, MX records via DNS
`threat_intel`	`GET /api/security/threat-intel`	IOC lookup -- AbuseIPDB + VirusTotal + OTX AlienVault with weighted confidence scoring for IPs, domains, URLs, hashes
`header_audit`	`GET /api/security/header-audit`	Security header score (0-100) -- HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, cookie flags
`vuln_headers`	`GET /api/security/vuln-headers`	Information leakage detection -- Server version, X-Powered-By, debug headers, CORS misconfiguration

Security tools degrade gracefully without API keys (heuristics-only mode). Optional keys: VT_API_KEY, ABUSEIPDB_API_KEY, ETHERSCAN_API_KEY.

Authentication

Three tiers -- use whichever fits:

Tier	How	Limit	Cost
Free	No auth needed	10 calls/day per IP	$0
API Key	`X-Api-Key` header	Unlimited	$9/mo
x402	`X-Payment` header	Pay per call	$0.005/call

API Key

Subscribe via Stripe to get an unlimited API key:

For migration only, query-string API keys (?apikey=) can be temporarily re-enabled with ALLOW_APIKEY_QUERY=true. This mode is deprecated; prefer X-Api-Key.

# 1. Create checkout session
curl -X POST https://mcp.skills.ws/billing/checkout
# Returns: { "url": "https://checkout.stripe.com/..." }

# 2. Complete payment at the Stripe URL
# 3. You'll receive your API key on the success page (shown once only -- save it)

# 4. Use it
curl -H "X-Api-Key: mcp_your_key" "https://mcp.skills.ws/api/whois?domain=example.com"

x402 Pay-per-call

No account needed. Pay with USDC or USDT on Base or Celo. x402-compatible agents handle payment automatically.

curl -H "X-Payment: <base64-encoded-json>" "https://mcp.skills.ws/api/screenshot?url=https://example.com"

REST API

All tools are also available as REST endpoints:

# Web Scraping
curl "https://mcp.skills.ws/api/scrape?url=https://example.com"
curl "https://mcp.skills.ws/api/crawl?url=https://example.com&depth=2&maxPages=10"
curl "https://mcp.skills.ws/api/extract?url=https://example.com"

# SEO
curl "https://mcp.skills.ws/api/serp?keyword=mcp+server"
curl "https://mcp.skills.ws/api/onpage-seo?url=https://example.com"
curl "https://mcp.skills.ws/api/keywords?keyword=ai+agents"

# Memory
curl -X POST "https://mcp.skills.ws/api/memory" \
  -H "Content-Type: application/json" \
  -d '{"namespace":"my-agent","key":"greeting","value":"Hello world","tags":["demo"]}'
curl "https://mcp.skills.ws/api/memory?namespace=my-agent&key=greeting"
curl "https://mcp.skills.ws/api/memory/search?namespace=my-agent&query=hello"

# Domain Intelligence
curl "https://mcp.skills.ws/api/whois?domain=example.com"
curl "https://mcp.skills.ws/api/dns?domain=example.com&type=ALL"
curl "https://mcp.skills.ws/api/ssl?domain=example.com"

# Content
curl "https://mcp.skills.ws/api/screenshot?url=https://example.com&format=png"
curl "https://mcp.skills.ws/api/pdf?url=https://example.com"
curl "https://mcp.skills.ws/api/pdf2docx?url=https://example.com/document.pdf"

# Blockchain
curl "https://mcp.skills.ws/api/chain/balance?address=0x...&chain=ethereum"
curl "https://mcp.skills.ws/api/chain/erc20?address=0x...&token=0x...&chain=celo"

# Security
curl "https://mcp.skills.ws/api/security/url-scan?url=https://suspicious-site.com"
curl "https://mcp.skills.ws/api/security/wallet-check?address=0x...&chain=ethereum"
curl "https://mcp.skills.ws/api/security/contract-scan?address=0x...&chainId=1"
curl "https://mcp.skills.ws/api/security/email-headers?domain=example.com"
curl "https://mcp.skills.ws/api/security/threat-intel?ioc=8.8.8.8&type=ip"
curl "https://mcp.skills.ws/api/security/header-audit?url=https://example.com"
curl "https://mcp.skills.ws/api/security/vuln-headers?url=https://example.com"

Environment Variables

Variable	Default	Description
`PORT`	`3100`	Server port
`CHROMIUM_PATH`	`/usr/bin/chromium-browser`	Path to Chromium
`MAX_BROWSERS`	`3`	Max concurrent browser instances
`MAX_SSE_SESSIONS`	`50`	Max MCP SSE sessions
`MAX_SSE_PER_IP`	`5`	Max concurrent SSE sessions per client IP
`SSE_CONNECT_MAX_PER_WINDOW`	`30`	Max SSE connection attempts per IP per window
`SSE_CONNECT_WINDOW_MS`	`60000`	SSE connect rate-limit window in ms
`SSE_ALLOWED_HOSTS`	--	Comma-separated allowlist for `Host` header on `/mcp/sse` + `/mcp/messages` (e.g. `mcp.example.com,localhost`)
`SSE_ALLOWED_ORIGINS`	--	Optional comma-separated allowlist for `Origin` header (full origins like `https://app.example.com`)
`FREE_DAILY_LIMIT`	`10`	Free tier request limit
`FREE_WINDOW_MS`	`86400000`	Free-tier rate-limit window in ms
`REDIS_URL`	--	Optional Redis backend for shared/distributed rate-limits
`API_KEYS`	--	Comma-separated valid API keys
`ALLOW_APIKEY_QUERY`	`true` in non-production, `false` in production	Allow deprecated `?apikey=` auth during migration
`ADMIN_SECRET`	--	Secret for admin endpoints
`STRIPE_SK`	--	Stripe API key for Pro subscriptions
`STRIPE_WEBHOOK_SECRET`	--	Stripe webhook signing secret
`STRIPE_WEBHOOK_IP_ALLOWLIST`	--	Optional CSV allowlist for webhook source IPs
`CHECKOUT_LIMIT_PER_HOUR`	`5`	Per-IP Stripe checkout creation limit
`X402_PRICE_USD`	`0.005`	x402 price per call
`X402_RECEIVER`	--	x402 payment receiver address
`X402_MAX_TX_AGE_SECONDS`	`86400`	Maximum accepted payment tx age in seconds (stale txs are rejected)
`X402_TX_CACHE_FILE`	`./data/x402-tx-cache.json`	Persistent replay-protection cache for used x402 tx hashes
`X402_TEST_MODE`	`0`	Set to `1` only for local/offline testing; ignored in production
`MEMORY_DB_PATH`	`./data/memory.db`	SQLite memory database path
`VT_API_KEY`	--	VirusTotal API key (free: 4/min, 500/day)
`ABUSEIPDB_API_KEY`	--	AbuseIPDB API key (free: 1000/day)
`ETHERSCAN_API_KEY`	--	Etherscan API key (free: 5/sec)
`TRUST_PROXY`	`false`	Express trust proxy setting (`false`, `true`, hop count like `1`, or subnet names/CIDRs like `loopback`/`10.0.0.0/8`)

Reverse proxy & client IP configuration

mcp-services defaults to TRUST_PROXY=false, which means the app ignores X-Forwarded-For and uses the direct socket peer IP for rate limits and free-tier memory namespacing.

Enable TRUST_PROXY only when your deployment is actually behind a trusted reverse proxy/load balancer that rewrites forwarding headers. Common options:

TRUST_PROXY=1 when exactly one trusted proxy sits in front of Node.js
TRUST_PROXY=loopback for local proxy setups
TRUST_PROXY=<cidr> (or comma-separated values) for explicit trusted proxy ranges

When trust proxy is enabled, Express derives req.ip from X-Forwarded-For according to that trust policy. Ensure your edge proxy:

Appends/sets a valid X-Forwarded-For chain
Prevents direct untrusted clients from spoofing forwarding headers
Forwards the real client address as the left-most IP in X-Forwarded-For

If X-Forwarded-For is present while TRUST_PROXY=false, the server logs a defensive warning and ignores that header.

For production, set SSE_ALLOWED_HOSTS and SSE_ALLOWED_ORIGINS to strict, explicit values (only your public MCP domain and trusted app origins). Avoid wildcards or broad internal host lists.

Deployment hardening checklist (recommended)

Set NODE_ENV=production
Keep ALLOW_APIKEY_QUERY=false (header auth only)
Configure TRUST_PROXY correctly for your network path (do not blindly set true)
Set strict SSE_ALLOWED_HOSTS and SSE_ALLOWED_ORIGINS
Use REDIS_URL for shared rate-limits in multi-instance deployments
Rotate ADMIN_SECRET and Stripe keys periodically
Keep X402_TEST_MODE=0 in production (enforced by server)
Persist KEYS_FILE, MEMORY_DB_PATH, and X402_TX_CACHE_FILE on durable storage
Run npm audit in CI and fail builds on high/critical vulnerabilities

Production env quickstart

cp .env.production.example .env
# then edit .env values for your domain, proxy topology, redis and secrets

Stripe webhook edge allowlist auto-sync (nginx)

# Generate CIDR allowlist include from Stripe source and reload nginx
scripts/sync-stripe-webhook-ips.sh \
  --out /etc/nginx/snippets/stripe-webhook-allowlist.conf \
  --reload "systemctl reload nginx"

See deploy/nginx/stripe-webhook.conf.example for the webhook location block.

Security

SSRF protection: URL validation + DNS pre-resolution + private IP blocking + Puppeteer request interception
Domain validation: regex allowlist prevents command injection
Input sanitization: format validation per IOC type, address format checks, chain allowlists
Memory namespace isolation per auth tier (API key hash, IP, or x402)
Rate limiting on free tier
Resource limits: max concurrent browsers, SSE sessions, PDF size cap, 5MB response body limit
Response size limits on external API fetches

Architecture

                  +------------------------------------+
                  |          Express Server             |
                  |                                     |
                  |  +---------+    +--------------+    |
  MCP SSE ------->  | MCP SDK |    |  Auth Layer   |   |
                  |  |  (SSE)  |    | free/key/x402 |   |
                  |  +---------+    +--------------+    |
                  |                                     |
  REST API ------>  +--------------------------------+  |
                  |  |        29 Tool Handlers        |  |
                  |  | scrape | crawl | extract       |  |
                  |  | serp | onpage_seo | keywords   |  |
                  |  | memory (5) | screenshot | pdf  |  |
                  |  | html2md | ocr | whois | dns    |  |
                  |  | ssl | balance | erc20 | tx     |  |
                  |  | url_scan | wallet_check        |  |
                  |  | contract_scan | email_headers   |  |
                  |  | threat_intel | header_audit     |  |
                  |  | vuln_headers                    |  |
                  |  +--------------------------------+  |
                  |        |              |              |
                  |  +-----+----+  +-----+----------+   |
                  |  | Puppeteer|  | viem (6 RPCs)   |   |
                  |  | Chromium |  | whois-json      |   |
                  |  |          |  | dns/promises    |   |
                  |  |          |  | security.js     |   |
                  |  +----------+  +-----------------+   |
                  |                                     |
  Stripe -------->  +--------------------------------+  |
  Webhooks        |  |   Billing (stripe.js)          |  |
                  |  |   checkout -> key provisioning  |  |
                  |  +--------------------------------+  |
                  +------------------------------------+

Stack

Runtime: Node.js 22 + Express
Browser: Puppeteer (Chromium) -- screenshots, PDF, OCR, html2md
Blockchain: viem -- 6 EVM chains via public RPCs
Security: VirusTotal, AbuseIPDB, Etherscan, Honeypot.is, OTX AlienVault + heuristics
Payments: Stripe (subscriptions), x402 protocol (stablecoins on Base/Celo)
MCP: @modelcontextprotocol/sdk with SSE transport
Hosting: Aleph Cloud (decentralized compute)

License

MIT -- Commit Media SARL

mcp-services