# app.surewhynot.quartermaster/quartermaster

> x402 toolkit for AI agents: paid web, AI, and Base chain tools per call in USDC. Free tools too.

- name: app.surewhynot.quartermaster/quartermaster
- version: 1.6.0
- connection class: R0 (autonomous)
- trust: 75/100 flags: no-repository
- quality: 79/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/app.surewhynot.quartermaster%2Fquartermaster
- tools: https://api.protogrid.dev/v1/servers/app.surewhynot.quartermaster%2Fquartermaster/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "quartermaster": {
      "type": "http",
      "url": "https://quartermaster.surewhynot.app/mcp"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 98
- freshness: 65
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-96% ~updated-106d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 79/100 (good)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 71 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- fail `tools.annotations`: no tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: x402_router (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); qr_generate (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); translate_text (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …
- pass `tools.token_cost`: about 3,493 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 49, about 3,493 tokens to load them all
- tool set hash: d3bcb8879092f21423e07560f2cf1e73
- badge: [![protogrid quality](https://protogrid.dev/badge/app.surewhynot.quartermaster/quartermaster.svg)](https://protogrid.dev/servers/app.surewhynot.quartermaster/quartermaster)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Remotes

- https://quartermaster.surewhynot.app/mcp (streamable-http, auth none, reachable true, uptime30d 0.9557522)

## Packages

_none_

## Tools (49)

- `base64`: [Dev] Base64 encode or decode a string. Costs $0.001.
- `base_allowance`: Check an ERC-20 spending allowance on Base; flags unlimited approvals. Costs $0.001.
- `base_contract`: Determine whether a Base address is a contract or an EOA. Costs $0.001.
- `base_token_info`: ERC-20 name, symbol, decimals, total supply for a token on Base. Costs $0.001.
- `base_usdc_transfers`: Recent USDC transfers (in and out) for an address on Base. Costs $0.002.
- `classify_text`: [AI] Zero-shot classification of text into caller-supplied labels; the result is validated back into your label set so you can route on it. Costs $0.002.
- `current_time`: FREE (no wallet needed): current time as ISO, unix, UTC, and optional local time for an IANA timezone.
- `describe_image`: [AI] AI vision: describe a public image URL, including visible text. Costs $0.005.
- `dns_lookup`: [Web] Resolve DNS records over DNS-over-HTTPS (A, AAAA, CNAME, MX, NS, TXT, and more). Costs $0.001.
- `embed_text`: [AI] Text embeddings (1024-dim vector) for semantic search and RAG. Costs $0.002.
- `extract_structured`: Structured extraction: JSON Schema plus a URL or raw text in, matching JSON out. Costs $0.005.
- `gas_prices`: [Crypto/Base] Current Base gas prices with a simple-transfer cost estimate. Costs $0.001.
- `generate_uuid`: FREE (no wallet needed): generate UUID v4 values, up to 100 at once.
- `hash_string`: FREE (no wallet needed): SHA-1/256/384/512 hex digest of a string.
- `http_check`: [Web] Liveness/latency pre-flight for a URL: is it up, HTTP status and class, response latency in ms, whether it redirects and where, content-type and server. Costs $0.001. Use before relying on a dependency.
- `http_error_explain`: [Web] Explain an HTTP status code: meaning, common causes, fixes, retry guidance. Costs $0.001.
- `http_errors_list`: FREE (no wallet needed): index of documented HTTP status codes (use http_error_explain for a paid detailed explanation).
- `jwt_decode`: [Dev] Decode a JWT header and payload (signature NOT verified). Costs $0.001.
- `moderate_text`: [AI] Content-safety classification (Llama Guard): safe flag plus category codes. Costs $0.002.
- `page_meta`: [Web] Get page metadata: title, description, Open Graph, canonical URL, favicon, language. Costs $0.002.
- `payment_proof`: [x402] Verify an x402 settlement on Base OR Solana from a tx id (0x hash or base58 signature): confirm it succeeded, decode its USDC transfers, optionally assert payTo/amount - returns a single verdict. Costs $0.003. Choose this when you only need the yes/no did-it-land answer; use settlement_assurance for the full scored report (proof + receipt + optional endpoint audit).
- `payment_receipt`: [x402] Formatted settlement receipt for a Base transaction (0x hash) or Solana settlement (base58 signature): timestamp, decoded transfers, explorer link. Costs $0.002. Choose this for a human-readable record; use payment_proof to ASSERT a specific payTo/amount, or settlement_assurance for a full scored verdict.
- `public_holiday`: [Dev] Is a date a public holiday in a country (2-letter ISO code)? Returns the holiday name, its types, and the next upcoming holiday. Costs $0.001. Useful for scheduling.
- `qr_generate`: [Web] Generate a QR code as SVG (or terminal text with format=text). Costs $0.002.
- `quartermaster_info`: Free: catalog, prices, and payment instructions for this server.
- `random_numbers`: [Dev] Cryptographically-secure random integers in a range (CSPRNG, unbiased) — real entropy an LLM cannot produce itself. Costs $0.001.
- `random_pick`: [Dev] Pick one or several options at random from a caller-supplied list (CSPRNG), optionally without replacement. Costs $0.001.
- `regex_test`: [Dev] Test a regular expression against text; returns every match with numbered and named capture groups. Deterministic. Costs $0.001.
- `resolve_basename`: Resolve a Basename (.base.eth) to a wallet address on Base. Costs $0.001.
- `settlement_assurance`: [x402] FLAGSHIP: from a tx id on Base (0x hash) or Solana (base58 signature), prove a completed x402 payment is real and sound - onchain success, USDC transfer match to an expected wallet/amount, a receipt, and an optional audit of the issuing endpoint - as one 0-100 scored report with a verdict. Costs $0.03. This is the most complete post-payment check; use payment_proof if you only need a plain pass/fail, tx_status for raw status, or x402_audit to grade a seller endpoint by URL (no payment yet).
- `summarize_url`: [AI] AI summary of a public webpage (fetch + extract + summarize). length: short|medium|long. Costs $0.01.
- `text_diff`: [Dev] Compact line-level diff between two texts. Costs $0.001.
- `text_stats`: [Dev] Word/sentence counts, reading time, and readability score for text. Costs $0.001.
- `tldr_text`: [AI] Summarize raw text you pass in directly (not a URL). length: short|medium|long. Costs $0.005. Use summarize_url when you have a URL instead.
- `token_price`: [Crypto/Base] USD price for major tokens by symbol or any Base ERC-20 by address. Costs $0.001.
- `translate_text`: [AI] AI translation into any target language; source auto-detected. Costs $0.005.
- `tx_decode`: [Crypto/Base] Decode a Base transaction's calldata into the function it called and its arguments — ERC-20 transfer/approve and the EIP-3009 transferWithAuthorization used by x402 settlements. Recognizes x402 settlement transactions and formats USDC amounts. Costs $0.003. Use tx_status for pass/fail; use this to see WHAT a transaction did.
- `tx_status`: [Crypto/Base] Check a Base transaction: success/reverted/pending, confirmations, gas, explorer link. Costs $0.002. Choose this for a quick raw status; use payment_receipt for decoded transfers, or settlement_assurance to PROVE an x402 payment settled to the right wallet/amount.
- `unshorten_url`: [Web] Expand a shortened/redirecting URL: follow the redirect chain and return every hop plus the final destination. Each hop is SSRF-validated. Costs $0.002. Safe way to see where an untrusted link goes.
- `usdc_normalize`: Convert USDC amounts between atomic units and human decimals. Costs $0.001.
- `wallet_balance`: [Crypto/Base] ETH and USDC (or any ERC-20) balance for an address on Base. Costs $0.001.
- `web_extract`: [Web] Extract clean readable text and metadata from a public webpage as structured JSON. Costs $0.005 (USDC via x402).
- `x402_audit`: [x402] WORKFLOW: full scored audit of an x402 SELLER endpoint (a URL) in one call - verifies the 402 challenge, payment fields, Bazaar discovery metadata, and the origin's discovery surfaces; returns a 0-100 score, checks with evidence, and recommended fixes. Costs $0.01. Use this to grade an endpoint before trusting/publishing it; use settlement_assurance instead when you already have a transaction hash and want to prove a completed PAYMENT settled correctly.
- `x402_discover`: [x402] Search the Coinbase x402 Bazaar for paid resources by natural-language query. Costs $0.001.
- `x402_inspect`: [x402] Inspect and lint any x402 paid endpoint: decode the 402 challenge, identify network/asset, flag misconfigurations and Bazaar-readiness. Costs $0.002. Choose this for a quick one-shot decode+lint; use x402_audit for a full 0-100 scored report with origin discovery probes and recommended fixes.
- `x402_merchant`: [x402] List all x402 Bazaar resources under a merchant payTo wallet. Costs $0.001.
- `x402_router`: START HERE. One tool for anything x402, Base chain, or web/AI: describe your goal in plain English (q) and Quartermaster picks and runs the right underlying tool, returning the answer plus which tool it used. Examples: 'audit https://api.example.com/paid', 'price of eth', 'is 0x… a contract', 'verify settlement 0x…', 'search the bazaar for weather'. Use this when you don't want to choose among the individual tools below. Costs $0.03 (USDC via x402).
- `x402_simulate`: [x402] Pre-flight a payment BEFORE you spend: decode an endpoint's 402 challenge, report the cost on every rail (Base and Solana) and the cheapest, and — with an optional payer address — verify the wallet can afford the call on Base. Costs $0.003. Use this before paying an unfamiliar endpoint; use x402_inspect to lint an endpoint you own.
- `x402_test_vector`: [x402] Free: example x402 payment-requirement objects with field explanations.