VerifyLite
Pay-per-call web safety, Base on-chain data, CVE and prompt-injection checks for agents. x402 USDC.
| Endpoint | https://verifylite.hydratinghealingtouch.workers.dev/mcp (streamable-http) |
|---|---|
| Registry version | 1.2.0 |
| Now | 38 tools · grade B (86) · pin ts_137e2f3c2ec01e7b81bf604e096f95ca · protocol 2025-06-18 |
| First / last listed | 2026-11-02 01:48 UTC / 2026-11-02 01:48 UTC |
| Grade over time | 2026-11-02: B (86), 38 tools |
Is this your server? Own a server? ToolFit hosted watch re-checks it every 24 h ($0.25 per 30 days) or 6 h ($0.60) and sends you an HMAC-signed webhook when its tools or grade change: POST https://api.youraitools.co/toolfit/v1/watch. To opt out, see About & opt-out.
Tools: list_prices verify_url check_site_safety check_site_safety_pro check_sites_batch transcribe_audio read_page link_preview domain_report check_email seo_check chain_balance chain_tx chain_token chain_contract chain_gas chain_block token_report honeypot_check token_safety_check token_allowance_check wallet_sanctions_check wallet_transfers contract_events token_holders nft_lookup contract_call name_lookup crypto_price package_vulnerabilities check_prompt_injection repair_json read_feed get_time new_uuid random_number ip_info ping
list_prices | Lists every VerifyLite tool and its current price. Free. params: none |
verify_url | URL syntax validator. Takes one absolute HTTP or HTTPS URL and returns its normalized form, or a specific error code: unparseable, unsupported scheme, embedded credentials, IP literal, or local/metadata hostname. Never contacts the destination, so it is fast and side-effect free. Useful for cleaning URLs from user input, scraped pages, or LLM output before fetching them. Paid via x402; see list_pr params: url* |
check_site_safety | Website safety check for one URL. Passively fetches the site and returns a verdict (safe, caution, unsafe), a 0-100 score, and evidence-backed flags: TLS validity, HTTP-to-HTTPS redirect, redirect chain and offsite redirects, security headers, mixed content, insecure forms, and domain age from the official registry. Useful before visiting, linking to, buying from, or submitting data to an unfamili params: url* |
check_site_safety_pro | Website safety check plus a Google Web Risk lookup for malware, phishing, and unwanted software. Includes the full /safe report: verdict (safe, caution, unsafe), 0-100 score, TLS, redirects, security headers, mixed content, insecure forms, and domain age. A blocklist hit makes the verdict unsafe. Useful for screening links before a payment, login, or download. Not charged if the blocklist cannot b params: url* |
check_sites_batch | Batch website safety check: the full /safe report for several URLs in one call, priced per site and cheaper than single checks. Each result has a verdict (safe, caution, unsafe), a 0-100 score, and evidence-backed flags for TLS, redirects, security headers, mixed content, insecure forms, and domain age, plus a summary count. Useful for screening every link in a search result, email, or document at params: urls* |
transcribe_audio | Speech-to-text for one audio or video file by URL, using Whisper (turbo) on a GPU. Returns the full transcript, timed segments, ready-made SRT and WebVTT captions, and the detected language; optional translation to English. Files up to 25 MB (about 25 minutes of typical MP3). Useful for captioning videos, indexing podcasts, or reading meetings. Not charged if the file can't be fetched or transcrib params: url*, language, translate |
read_page | Web page to markdown for AI agents: fetch one URL and get its main content as clean, LLM-ready markdown (navigation, ads, footers and scripts removed) with title, description, language, word count and a token estimate. Uses the site's own Markdown version when it offers one. Useful for RAG, summarizing articles, research and feeding pages to an LLM. Not charged if the page can't be fetched or isn' params: url* |
link_preview | Link preview: returns the title, description, preview image, site name, favicon, canonical URL, and Open Graph/Twitter card details for one URL, like a chat app's link unfurl. Useful when an agent posts, shares, or summarizes links and needs clean metadata without reading the whole page. Not charged if the page can't be fetched. Paid via x402; see list_prices. params: url* |
domain_report | Domain intelligence: WHOIS/RDAP registration (registrar, created and expiry dates, status, name servers) plus DNS records (A, AAAA, MX, NS, TXT, CAA) and email security (SPF, DMARC), with flags for new, expiring or misconfigured domains, as one JSON object. Useful for vetting a company, vendor or link before trusting it. Not charged for invalid or reserved domain names. Paid via x402; see list_pri params: domain* |
check_email | Email check: validates the address format, confirms the domain exists and accepts mail (MX), and flags disposable providers, role accounts (info@, support@), and free providers. Returns deliverable_likely, risky, undeliverable, or invalid with a reason. No message is sent. Useful for cleaning sign-up lists and lead data before outreach. Paid via x402; see list_prices. params: email* |
seo_check | SEO check for one page: whether search engines can index it (meta robots, X-Robots-Tag, robots.txt rules), title and meta description length, canonical URL, H1 headings, viewport, language, Open Graph tags, sitemap, HTTPS, and redirects, with a 0-100 score and a list of issues by severity. Useful for site audits and pre-launch checks. Not charged if the page can't be fetched. Paid via x402; see li params: url* |
chain_balance | Base mainnet balance for one address: ETH and USDC (human-readable and raw), plus up to 10 ERC-20 tokens you list (with symbol and decimals), transaction count, and whether it is a wallet or a contract. One price for 0 to 10 tokens. Useful for checking a wallet is funded before a payment, confirming a payout or airdrop landed, tracking agent or treasury wallets, or screening a counterparty. Read-o params: address*, tokens |
chain_tx | Base mainnet transaction lookup by hash: status (success, failed, or pending), block, timestamp, confirmations, from, to, ETH value, total fee including the L1 data fee, method id, and every USDC transfer in the transaction decoded to sender, recipient, and amount. Useful for confirming that a USDC or x402 payment really settled before delivering goods. Read-only. Not charged for an invalid hash, params: hash* |
chain_token | ERC-20 token metadata for one contract on Base mainnet: name, symbol, decimals, and total supply (human-readable and raw), with a flag for whether it behaves like an ERC-20 at all and whether it is native USDC. Handles older tokens that return bytes32 names. Useful for formatting token amounts correctly and spotting look-alike tokens. Read-only. Not charged for an invalid address or an address wit params: address* |
chain_contract | Inspects one Base mainnet address: whether it holds contract code and how large, whether it is an EIP-1967 upgradeable proxy (and its implementation address), EIP-7702 delegation, and which standards it reports or behaves like (ERC-165, ERC-721 NFT, ERC-1155, ERC-20). Useful for knowing what kind of contract an agent is about to interact with or approve. Read-only. Not charged for an invalid addre params: address* |
chain_gas | Current Base mainnet gas: gas price, base fee, and priority fee in gwei, plus estimated execution cost in ETH for an ETH transfer, a USDC transfer, and a typical swap, from the latest block. Useful for timing transactions and budgeting fees before sending. No input needed. Not charged when Base can't be reached. Paid via x402; see list_prices. params: none |
chain_block | Base mainnet block details for the latest block or a given block number: number, hash, timestamp, transaction count, gas used and limit, and base fee. Useful for checking chain head and freshness, timestamping events, and counting confirmations. Read-only. Not charged for an invalid or future block number or when Base can't be reached. Paid via x402; see list_prices. params: number |
token_report | One-call due diligence for a Base token before buying, accepting or listing it: owner powers in the contract (mint, pause, blacklist, fees, proxy), who holds the supply (top wallets, concentration), whether it can actually be sold and its real buy/sell tax (simulated), and whether the token or its owner is on the OFAC sanctions list or a scam blacklist. Returns one verdict (ok, caution, avoid, kno params: token* |
honeypot_check | Honeypot and sell-tax check for a Base token. Finds its deepest WETH or USDC pool (Uniswap V2/V3, Aerodrome, Slipstream) and simulates a buy then a sell on a Base node: no money moves. Returns whether selling works, the actual buy tax and sell tax, round-trip loss, pool and liquidity, with a verdict: clean, taxed, high_tax, honeypot, no_liquidity or inconclusive. Useful before an agent buys, swaps params: token*, amountEth |
token_safety_check | Risk check for an ERC-20 token on Base before buying, accepting, or holding it: reads the contract and its proxy implementation for owner powers (minting, pausing, blacklisting wallets, changing buy/sell taxes, trade limits, trading switches, burning others' tokens, upgrades), checks whether ownership was renounced and how much supply the owner holds. Returns a verdict, 0-100 risk score, and plain params: address* |
token_allowance_check | Approval check for one wallet and one ERC-20 token on Base: how much each spender (up to 10 app or router addresses) is allowed to move, flagging unlimited approvals and approvals covering the full balance, plus approvals made through Uniswap Permit2 with their expiry. Defaults to checking Permit2 itself. Useful before signing, for wallet hygiene, and for spotting approvals to revoke. Read-only. N params: owner*, token*, spenders |
wallet_sanctions_check | Screens 1 to 20 wallet addresses against the US Treasury OFAC SDN sanctions list (crypto addresses) and the ScamSniffer scam and drainer blacklist, in one call at one price. Returns block or clear per address with the reason, plus list sizes and freshness. Address-level, so it works for Base, Arc, Ethereum and any EVM chain. Useful before sending a payment, paying an x402 seller, accepting funds, params: addresses* |
wallet_transfers | Recent token transfers for one Base wallet, incoming and outgoing, newest first: token, symbol, amount, sender, recipient, transaction hash, block and time, with likely spam airdrops flagged. Filter by one token or by direction, up to 50 per call. Reports the block window searched. Useful for checking a counterparty's activity, confirming deposits, reconciling payments, or watching an agent's wall params: address*, limit, token, direction |
contract_events | Recent events (logs) one Base contract emitted, newest first, decoded: token transfers and approvals with amounts, Uniswap/Aerodrome swaps, liquidity and reserve updates, WETH wraps, NFT transfers, and admin actions (ownership changes, proxy upgrades, pauses, role grants) flagged. Filter by event name to search about 22 hours back. Counts by event type and the block window searched. Read-only. Not params: contract*, limit, event |
token_holders | The largest holders of an ERC-20 token on Base, ranked, with balance, percent of supply and wallet/contract/burn type, read straight from the chain. Top 1/5/10 concentration (burns excluded), a wallets-only share, burned percent and a low-to-very-high level. For tokens whose whole transfer history fits (most new and small tokens) the list and holder count are exact; otherwise coverage is reported. params: token*, limit |
nft_lookup | Look up one NFT on Base by contract and token ID: ERC-721 or ERC-1155, current owner (wallet or contract), collection name and symbol, and its metadata: name, description, image link, animation, traits. Reads ipfs://, ar://, https and inline on-chain metadata. Pass owner to confirm a wallet holds it (and its ERC-1155 balance). Read-only. Not charged for invalid input, tokens that don't exist, or w params: contract*, tokenId*, owner, includeImage |
contract_call | Call any read-only (view/pure) function on a Base contract and get the decoded answer. Give the function as a signature like balanceOf(address) returns (uint256) plus args, or raw 0x calldata. Supports address, bool, uint/int, bytesN, string, bytes and arrays, an optional historical block, and plain revert reasons. Raw return data is always included. Not charged for invalid input, reverted calls, params: contract*, function, args, returns, data, block |
name_lookup | Resolves Basenames (name.base.eth, on Base) and ENS names (name.eth, on Ethereum) to wallet addresses, including a Base-specific address and profile records (avatar, description, url, X, GitHub). Or give an 0x address to get its primary name, verified by resolving the name back to the same address. A bare name like jesse means jesse.base.eth. Useful before sending funds to a name or labeling count params: name* |
crypto_price | Current prices in USD from Chainlink Data Feeds on Base mainnet: ETH, BTC, cbBTC, SOL, USDC, DAI, and EUR. One pair or all at once, each with the feed's last update time, age in seconds, and a stale flag, read straight from the oracle contracts (the same prices DeFi protocols use). Useful for valuing balances, converting USDC amounts, and checking a stablecoin peg. Not charged for an unknown pair params: pair |
package_vulnerabilities | Check dependencies for known vulnerabilities before installing or shipping: up to 20 packages (npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet, Packagist and more, by name and version or purl) against the OSV.dev database. Returns each advisory with CVE IDs, severity and CVSS score, fixed versions, the smallest safe upgrade, and links. Not charged for invalid input or if OSV.dev can't be reached. params: packages, ecosystem, name, version, purl |
check_prompt_injection | Prompt injection detection for AI agents: classify untrusted, agent-bound text or a URL (web pages, emails, tool and MCP output, RAG documents) as clean, suspicious or malicious before your LLM reads it. Returns a 0-100 risk score, each matched pattern (instruction overrides, jailbreaks, fake system prompts, requests for keys or seed phrases, exfiltration links, invisible Unicode, hidden HTML) and params: text, url |
repair_json | Turns messy LLM output into valid JSON: strips Markdown code fences and surrounding prose, fixes trailing commas, single quotes, unquoted keys, comments, Python True/None, cut-off brackets, and stringified JSON. Optionally validates the result against a JSON Schema (draft 4 to 2020-12) and lists each error with its location. Returns the parsed data, the JSON text, and what was changed. Not charged params: text*, schema |
read_feed | RSS and Atom reader: give a feed URL or any news site, blog, or podcast page and get its latest items as clean JSON: title, link, published date, author, a plain-text summary, and media (podcast audio) links. Finds the feed automatically from the page when needed. Useful for news monitoring, research digests, and tracking competitors or releases. Not charged if no feed is found or it can't be fetc params: url*, limit |
get_time | Current time from a reliable server clock: UTC ISO timestamp, Unix seconds and milliseconds, and optionally the local date, time, weekday, and UTC offset in any IANA time zone (daylight saving handled). Useful because language models don't know the current date or time. Not charged for an unknown time zone. Paid via x402; see list_prices. params: tz |
new_uuid | Generates standards-compliant UUIDs from a cryptographic random source: version 4 (random) or version 7 (time-ordered, sorts by creation time, good for database keys), one or up to 100 per call. Useful for idempotency keys, record IDs, and correlation IDs. Not charged for invalid options. Paid via x402; see list_prices. params: version, count |
random_number | Cryptographically secure, unbiased randomness: whole numbers between min and max (default 1 to 100), or random picks from a list of choices, one or up to 100 per call. Useful because language models are bad at being random: fair draws, sampling, shuffling decisions, and A/B assignment. Not charged for invalid options. Paid via x402; see list_prices. params: min, max, count, choices |
ip_info | Classifies an IPv4 or IPv6 address: family, canonical form, and whether it is public, private (RFC 1918 or unique local), loopback, link-local, carrier-grade NAT, multicast, documentation, or reserved, including IPv4-mapped IPv6. With no input over HTTP, returns the caller's own public IP and country. Useful for validating network input and filtering internal addresses. Not charged for an invalid params: ip |
ping | x402 integration test for agents and payment clients: after a real USDC payment it confirms the payment arrived and echoes back what the server saw: network (Base or Arc), scheme, payer address, amount, asset and recipient, plus server time and an optional echo string. Useful for checking that a wallet, x402 client and budget limits work end to end before calling costlier services, and for uptime params: echo |
Entries describe changes in tool definitions. They are not statements about a server, its quality or its author. The grade measures how the tool definitions fit model providers (token cost, schema compatibility, confusable names) as scored by the ToolFit engine at the time of the listing. JSON: append .json. Opt-out: how or hello@youraitools.co.