{"name":"ToolFit","description":"ToolFit checks the tool list your agent loads, before it costs you: token cost per tool, which tools models will confuse (with fix hints), schemas that OpenAI, Anthropic, Gemini, Bedrock or MCP reject (with fixed definitions per provider), basic tool-poisoning patterns, and a pin (fingerprint) so a later diff call labels every change as breaking, review, suspicious or additive. Send a tools array (MCP, OpenAI, Anthropic, Gemini or Bedrock form) or a public remote MCP URL. The check tier (MCPCheck) preflights a remote MCP server: handshake, protocol version, sign-in method, x402 terms, latency, tool list and grade. Hosted watch: register a remote MCP server and an https webhook; ToolFit re-audits it every 24 h or 6 h for 30 days and sends an HMAC-SHA256 signed notification when its tools or grade change. Pay per call over x402 or with prepaid credits; free tier on the remote MCP endpoint.","paid":[{"tier":"lite","methods":["GET","POST"],"path":"/v1/lite","params":["tools","url","providers"],"price":"$0.003","returns":"grade, score, tokens, per-provider verdicts, top confusable pairs, poisoning count, pin.","network":"eip155:8453","asset":"USDC","payTo":"0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F","facilitator":"https://facilitator.payai.network","x402":["v2","v1"]},{"tier":"full","methods":["GET","POST"],"path":"/v1/full","params":["tools","url","providers"],"price":"$0.01","returns":"Everything in lite plus issues[], fixed definitions per provider, pair details, lints and fingerprints.","network":"eip155:8453","asset":"USDC","payTo":"0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F","facilitator":"https://facilitator.payai.network","x402":["v2","v1"]},{"tier":"diff","methods":["GET","POST"],"path":"/v1/diff","params":["pin","baseline","tools","url"],"price":"$0.002","returns":"verdict, advice, counts, labeled changes with before/after, new pin.","network":"eip155:8453","asset":"USDC","payTo":"0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F","facilitator":"https://facilitator.payai.network","x402":["v2","v1"]},{"tier":"check","methods":["GET","POST"],"path":"/v1/check","params":["url"],"price":"$0.005","returns":"verdict, grade, reachability, protocol, auth, x402 terms, latency, tool summary, issues, pin.","network":"eip155:8453","asset":"USDC","payTo":"0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F","facilitator":"https://facilitator.payai.network","x402":["v2","v1"]},{"tier":"watch","methods":["POST"],"path":"/v1/watch","params":["url","webhook","every"],"price":"$0.25","returns":"watch_id, secret (once), every, expires_at, baseline {pin, grade, score, tools}, status_url, how to verify signatures.","network":"eip155:8453","asset":"USDC","payTo":"0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F","facilitator":"https://facilitator.payai.network","x402":["v2","v1"]},{"tier":"watch6h","methods":["POST"],"path":"/v1/watch/6h","params":["url","webhook","every"],"price":"$0.60","returns":"watch_id, secret (once), every, expires_at, baseline, status_url, how to verify signatures.","network":"eip155:8453","asset":"USDC","payTo":"0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F","facilitator":"https://facilitator.payai.network","x402":["v2","v1"]}],"payTo":"0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F","free":["/health","/mcp","/v1/stats","/v1/rules","/v1/watch/status","/v1/watch/cancel","/openapi.json","/.well-known/x402"],"freeTier":{"mcp":{"method":"POST","path":"/mcp","transport":"streamable-http","tools":["audit_tools","diff_tools","check_mcp_server","watch_mcp_server","watch_status","watch_cancel"],"limit":"20 audit_tools/diff_tools calls and 10 check_mcp_server calls per IP per UTC day (max 10/min); full results","then":"x402 per call or prepaid credits"}},"engine":"toolfit-0.1.0","sources":{"rules":{"openai_root":"https://github.com/langchain-ai/langchainjs/issues/9804","openai_strict":"https://platform.openai.com/docs/guides/structured-outputs","openai_additional":"https://github.com/RooCodeInc/Roo-Code/pull/10472","gemini_items":"https://github.com/backstage/backstage/issues/34038","gemini_schema":"https://ai.google.dev/api/caching#Schema","gemini_fn":"https://ai.google.dev/api/caching#FunctionDeclaration","anthropic_tools":"https://docs.anthropic.com/en/docs/agents-and-tools/tool-use/implement-tool-use","bedrock_toolspec":"https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ToolSpecification.html","mcp_tools":"https://modelcontextprotocol.io/specification/2025-06-18/server/tools","normalize":"https://github.com/HKUDS/nanobot/pull/2287","openai_desc_1024":"https://github.com/modelcontextprotocol/servers/issues/799","openai_128_tools":"https://github.com/HolmesGPT/holmesgpt/issues/1050"},"mcp_spec":"https://modelcontextprotocol.io/specification/2025-06-18"},"policy":{"custody":"never pays other endpoints, never holds customer funds, never asks for keys or credentials","network":"URL mode sends only MCP initialize, notifications/initialized and tools/list; it never calls a tool","charging":"only HTTP 200 results are settled; bad input (400), blocked URLs (400), unreachable servers (422), unknown pins (404) and timeouts (503) are free","privacy":"Pins store the normalized tool definitions (names, descriptions, schemas, annotations) under their hash for 90 days after last use so diff calls can show before/after text. No IPs, payer addresses or request headers are stored. Watches store the server URL, your webhook URL, the signing secret and the last result (pin, grade, score, tool count, delivery counters) until 7 days after they expire or are cancelled, then delete them. The MCP Registry change history stores the public tool definitions that registry-listed servers return to tools/list, with dates, pins and grades; owners can opt out (see /toolfit/history/about); opt-out requests are logged with their time and a salted IP hash, never the raw IP."},"limits":["Up to 500 tools and 600 KB per request; pair analysis covers the first 300 tools.","URL mode: https only, public hosts only (private, loopback, link-local and metadata addresses are blocked after DNS resolution, redirects re-checked, max 3), 15 s total, 1 MB per response, up to 10 tools/list pages. Only initialize and tools/list are sent: tools are never called.","Token counts are estimates (about 4 characters per token of the JSON definition).","Free tier (remote MCP): 20 audit/diff calls and 10 server checks per IP per UTC day, max 10/min.","Watch: 30 days per purchase, every 24 h ($0.25) or every 6 h ($0.60); max 2,000 active watches in total. Webhooks: https, port 443, public hosts only (same SSRF rules), no redirects, 5 s timeout, one retry. Cancelled watches are not refunded."],"disclaimer":"Deterministic checks of tool definitions (no LLM). URL mode lists tools and never calls them. A clean result is not a security guarantee: it cannot see what a server does at run time.","source":"https://api.youraitools.co/toolfit/","allTools":"https://youraitools.co/built-by-us","credits":"https://api.youraitools.co/credits/","endpoint":"https://api.youraitools.co/toolfit","networks":[{"network":"eip155:8453","name":"Base","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","symbol":"USDC","payTo":"0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F"},{"network":"eip155:137","name":"Polygon","asset":"0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359","symbol":"USDC","payTo":"0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F"},{"network":"eip155:42161","name":"Arbitrum One","asset":"0xaf88d065e77c8cC2239327C5EDb3A432268e5831","symbol":"USDC","payTo":"0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F"}]}