# io.github.mercuryx402/mercury-x402-mcp
> Agent-payable web data over x402: 18 keyless services an agent pays per call.
- name: io.github.mercuryx402/mercury-x402-mcp
- version: 1.0.1
- connection class: R0 (autonomous)
- trust: 87/100
- quality: 68/100 (needs work)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.mercuryx402%2Fmercury-x402-mcp
- tools: https://api.protogrid.dev/v1/servers/io.github.mercuryx402%2Fmercury-x402-mcp/tools
**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.
## Connection (mcpServers)
```json
{
"mcpServers": {
"mercury-x402-mcp": {
"type": "http",
"url": "https://network.mercury-hq.com/mcp"
}
}
}
```
## Trust
- hygiene: 100
- liveness: 100
- freshness: 65
- provenance: 80
- drivers: +repository +namespace-matches-repo +reachable +uptime-99% ~updated-136d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.
## Quality 68/100 (needs work)
### protocol: 75 (weight 25)
- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers
### authorization: n/a (weight 15)
- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL
### tool hygiene: 64 (weight 30)
- pass `tools.descriptions`: every tool has a description
- warn `tools.description_length`: 2 tools have descriptions over 1,024 characters, which crowds the context
- pass `tools.schemas`: every tool has an object input schema
- fail `tools.annotations`: no tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: fetch (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); robots (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); diff (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …
- pass `tools.token_cost`: about 4,205 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump
### stability: 100 (weight 15)
- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name
### dependencies: 33 (weight 15)
- fail `deps.known_vulns`: 3 advisories to act on (malicious, or rated high or critical with a fix available): GHSA-8r9p-f939-6h3c in follow-redirects@1.16.0 (indirect, fixed in 1.16.1), GHSA-q3jh-wrc6-jgq8 in follow-redirects@1.16.0 (indirect, fixed in 1.16.1), GHSA-96hv-2xvq-fx4p in ws@8.18.0 (indirect, fixed in 8.21.0); 5 more of lower severity or without a fix
- fail `deps.mcp_sdk_version`: @modelcontextprotocol/sdk 1.30.1 has 3 known advisories (GHSA-22jm-h49p-29qw, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h); update @modelcontextprotocol/sdk to 1.32.0 or later
- pass `deps.resolvable`: mercury-x402-mcp@1.0.1 resolved: 543 packages
- tools: 18, about 4,205 tokens to load them all
- tool set hash: 2e58ef460fc95773d87d0162aee5a499
- badge: [](https://protogrid.dev/servers/io.github.mercuryx402/mercury-x402-mcp)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.
### Tool changes
_No tool definition changes recorded._
## Dependencies
- npm mercury-x402-mcp@1.0.1: resolved, 542 dependencies, MCP SDK @modelcontextprotocol/sdk 1.30.1
- GHSA-22jm-h49p-29qw (high) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.32.0 ``, advisory summary: "MCP TypeScript SDK: Experimental tasks were not tied to the session that created them" https://osv.dev/vulnerability/GHSA-22jm-h49p-29qw
- GHSA-6qxp-vccf-f47h (high) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.31.0 ``, advisory summary: "MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server" https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h
- GHSA-8r9p-f939-6h3c (high) in `` follow-redirects@1.16.0 ``, indirect, fixed in `` 1.16.1 ``, advisory summary: "follow-redirects sensitiveHeaders regex escaping can expose credential headers" https://osv.dev/vulnerability/GHSA-8r9p-f939-6h3c
- GHSA-q3jh-wrc6-jgq8 (high) in `` follow-redirects@1.16.0 ``, indirect, fixed in `` 1.16.1 ``, advisory summary: "follow-redirects array-form headers bypass cross-origin credential stripping" https://osv.dev/vulnerability/GHSA-q3jh-wrc6-jgq8
- GHSA-96hv-2xvq-fx4p (high) in `` ws@8.18.0 ``, indirect, fixed in `` 8.21.0 ``, advisory summary: "ws: Memory exhaustion DoS from tiny fragments and data chunks" https://osv.dev/vulnerability/GHSA-96hv-2xvq-fx4p
- GHSA-6prh-2h8m-c8cw (moderate) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.32.0 ``, advisory summary: "MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies" https://osv.dev/vulnerability/GHSA-6prh-2h8m-c8cw
- GHSA-vcc3-ghjq-m6fr (moderate) in `` decode-uri-component@0.2.2 ``, indirect, fixed in `` 0.5.0 ``, advisory summary: "decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input" https://osv.dev/vulnerability/GHSA-vcc3-ghjq-m6fr
- GHSA-5r4p-p66f-jhc7 (moderate) in `` hono@4.13.9 ``, indirect, fixed in `` 4.13.11 ``, advisory summary: "Hono: \`serveStatic\` decodes the request path a second time, leading to bypass of middleware on static paths" https://osv.dev/vulnerability/GHSA-5r4p-p66f-jhc7
- GHSA-w5hq-g745-h8pq (moderate) in `` uuid@8.3.2 ``, indirect, fixed in `` 11.1.1 ``, advisory summary: "uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided" https://osv.dev/vulnerability/GHSA-w5hq-g745-h8pq
- GHSA-w5hq-g745-h8pq (moderate) in `` uuid@9.0.1 ``, indirect, fixed in `` 11.1.1 ``, advisory summary: "uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided" https://osv.dev/vulnerability/GHSA-w5hq-g745-h8pq
- GHSA-58qx-3vcg-4xpx (moderate) in `` ws@8.18.0 ``, indirect, fixed in `` 8.20.1 ``, advisory summary: "ws: Uninitialized memory disclosure" https://osv.dev/vulnerability/GHSA-58qx-3vcg-4xpx
Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.
## Remotes
- https://network.mercury-hq.com/mcp (streamable-http, auth none, reachable true, uptime30d 0.9916667)
## Packages
- npm mercury-x402-mcp@1.0.1
## Tools (18)
- `availability`: URL → a signed uptime/status probe: up/down, HTTP status + class, reachability reason, final URL after redirects, and a measured responseMs — wrapped in an offline-verifiable provenance receipt that makes "it was up/down at T" provable SLA evidence. Deterministic verdict (responseMs is telemetry, not signed). Keyless, no LLM, no signup. — $0.005/call
- `batch`: List of URLs (≤20) → clean content for each + ONE signed receipt committing to a MERKLE ROOT over every page's contentHash. Tamper-evident multi-page snapshot with per-page membership proofs (selective disclosure). Deterministic (no LLM): same URL set + same source bytes ⇒ byte-identical root + proofs. SSRF-guarded per url; keyless x402, USDC on Base mainnet. — $0.02/call
- `diff`: URL + prior content-hash (or prior text) -> refetch, deterministic change-proof: changed? + a NEW signed receipt binding fromHash->toHash. Stateless; receipts chain into a tamper-evident audit trail of a page's evolution. Keyless x402, Base mainnet USDC. — $0.006/call
- `dns`: Domain → a SIGNED, timestamped DNS snapshot (A, AAAA, MX, NS, TXT, CNAME, SOA), normalised + sorted into a byte-stable record set with an offline-verifiable provenance receipt — proving exactly what the zone resolved to at that moment. Keyless, no LLM, no signup. (Normalisation is deterministic; DNS itself is mutable across time/TTL/geo — which is the very reason the snapshot is timestamped + signed.) — $0.006/call
- `extract`: TYPED structured extract for autonomous agents — URL + schema → a clean, type-safe JSON record. Where /buy/fetch returns page TEXT (and ?extract= returns string-only fields), THIS returns the schema-conformant object an LLM/RAG/trading pipeline actually consumes: pass ?url=…&schema=title,price:number,rating:number,inStock:boolean and get back { title:"…", price:19.99, rating:4.5, inStock:true } — numbers as numbers, booleans as booleans, absent fields null (honest). `schema` accepts the URL-friendly compact form (field[:type], type in string|number|integer|boolean) OR a Firecrawl/OpenAI-style JSON-Schema object ({"properties":{"price":{"type":"number"}}}). That is Firecrawl's paid 'JSON mode' headline guarantee — type-safety, 'numbers as numbers not strings' — done DETERMINISTICALLY from the page's own JSON-LD/OpenGraph/meta/microdata: keyless, NO LLM call, NO API key, NO signup, $0.004/call, paid in-band over HTTP 402 (x402, USDC on Base mainnet). The typed record is folded into the SIGNED provenance attestation too (EIP-191, ecrecoverable OFFLINE), so a buyer can prove the EXTRACTED FIELDS — not just raw bytes — are exactly what MERCURY resolved. Honest charge-per-ATTEMPT: every call returns a structured result (success OR an ok:false reason). Same SSRF guard, 5s timeout, 10MB cap, no mint. — $0.004/call
- `feed`: RSS/Atom feed URL → a SIGNED, normalized item list [{title,link,published,summary}] unified across RSS 2.0/RDF + Atom 1.0: CDATA unwrapped, HTML stripped, entities decoded, dates → ISO-8601 (publishedRaw kept verbatim, never fabricated). Deterministic — same feed bytes ⇒ byte-identical items; no LLM. Core 4 fields only (not full-content/media/author). Receipt = EIP-191 over the canonical item list. — $0.005/call
- `fetch`: VERIFIABLE keyless web-read for autonomous agents. Every result ships a cryptographically SIGNED provenance receipt (EIP-191 over sha256(text)+url+status+time) — the wedge a free scraper structurally CANNOT match: Jina r.jina.ai is free+keyless too, but its bytes are HEARSAY (no proof of what/where/when). MERCURY's `attestation` is ecrecoverable OFFLINE, forever, by you OR any downstream agent you forward the bytes to — proving the content is genuine + untampered (key pinned at /.well-known/mercury-attestation). For RAG, trading and agent-to-agent commerce that need provenance, that is the gap between data and evidence. Beyond that it's the keyless web-read primitive — NO API key, NO signup, NO account, NO monthly plan, the one fetch SKU a fresh agent can onboard to by itself instead of stopping to ask a human for a key. Give a ?url= and get back clean readable page text + title + status. Agent-native extras (opt-in): ?format=markdown for structure-preserving markdown, ?links=1 for an outbound-link graph (crawl frontier), and the headline wedge — STRUCTURED EXTRACT: ?extract=title,price,author,publishedAt returns a clean JSON record { title, price, author, publishedAt }, an LLM-ready row not a wall of text. That is Firecrawl's paid 'JSON mode' (they need an LLM call + an API key for it) done here DETERMINISTICALLY from the page's own JSON-LD/OpenGraph/meta/microdata — keyless, no LLM, $0.003. (?extract=1 still returns the legacy description + wordCount.) The extracted record is folded into the SIGNED attestation too, so a buyer can prove the FIELDS — not just the raw bytes — are exactly what MERCURY resolved. You pay in-band over HTTP 402 (x402, USDC on Base mainnet) — the wedge those tools can't match: they ALL gate behind a human-created API key + a credit-card plan, so an agent can't onboard itself. This one an agent finds in the x402 Bazaar and pays with zero human in the loop. Honest charge-per-ATTEMPT: every call returns a structured result (success OR an ok:false failure with a reason) — never a silent charge-then-500. Follows redirects, SSRF-guarded, 5s timeout, 10MB cap. Pure data, no mint — delivers in prod. — $0.003/call
- `headers`: URL → a deterministic HTTP security-headers audit (HSTS, CSP, X-Frame, X-Content-Type, Referrer-Policy, Permissions-Policy + more) with a letter grade and concrete findings, wrapped in a signed, offline-verifiable provenance receipt. Keyless, no LLM, no signup. — $0.005/call
- `links`: URL → a SIGNED outbound/internal link graph: every as an absolute URL + anchor text, classified internal vs external against the page origin, grouped by origin with a third-party-origin histogram (privacy-audit) and same/cross-origin counts (SEO). Deterministic — same page bytes ⇒ byte-identical graph; no LLM. Covers hyperlinks only (not rel/asset tags). Receipt = EIP-191 over the graph. — $0.005/call
- `markdown`: URL → clean, LLM-ready markdown (boilerplate/nav/ads stripped, headings + lists + links preserved) with a signed provenance receipt pinning the markdown to its source — the RAG-ingest primitive. Deterministic (no LLM): same URL + same source bytes ⇒ byte-identical markdown. — $0.005/call
- `metadata`: URL → one typed, SIGNED metadata record (JSON-LD + OpenGraph + Twitter-card + standard + canonical + title), by source. Deterministic, keyless, no LLM — the social-card/SEO/schema.org record an agent can PROVE. — $0.006/call
- `notarize`: Notarize any content (inline ?content= or a fetched ?url=) into a signed, offline-verifiable provenance receipt — sha256 contentHash + witnessed timestamp, attested by Mercury's pinned key. Deterministic, keyless, no LLM. The signed receipt is the product: it witnesses that these exact bytes existed in this exact form at this time (the one thing your own sha256() can't — a third-party witness). — $0.008/call
- `readability`: URL → a clean ARTICLE record { title, byline, publishedAt, article text } with boilerplate (nav/header/footer/sidebar/ads/share-bars/comment-forms) stripped via deterministic DOM density heuristics, plus a signed provenance receipt pinning the cleaned article to its source — the clean-citation primitive distinct from raw markdown. Deterministic (no LLM): same URL + same source bytes ⇒ byte-identical output. — $0.005/call
- `redirect`: URL → a SIGNED redirect/canonical resolution: the full hop chain [{url,status}] from the link you have to where it ACTUALLY lands, the final resolved URL + status, the page's , hop count, cross-origin flag and distinct origins traversed (affiliate-cloak / link-safety signal). Deterministic — same redirects ⇒ byte-identical resolution; no LLM. Follows HTTP 3xx only (no JS/meta-refresh execution — meta-refresh target surfaced un-followed). Receipt = EIP-191 over the resolved chain. — $0.005/call
- `robots`: Domain → signed, timestamped per-AI-crawler allow/block audit from robots.txt + llms.txt + ai.txt (GPTBot, ClaudeBot, PerplexityBot, Google-Extended, Bytespider, …). Deterministic, no LLM. EU-AI-Act / TDM opt-out evidence: the signed verdict proves the crawler policy as it stood at fetch time. — $0.005/call
- `sitemap`: Domain/URL → a SIGNED snapshot of the site's PUBLISHED sitemap: discovers the sitemap via robots.txt Sitemap: lines then /sitemap.xml fallback, parses + (follows up to 5 child sitemaps), returns a deduped, bounded (≤2000) URL inventory with lastmod/changefreq/priority. The receipt signs the DECLARED URL list (deterministic — same sitemap bytes ⇒ byte-identical list). Optional ?fetch=N (≤10) adds a HARD-BOUNDED same-domain liveness probe (title+status+bytes per URL) — that probe is the ONLY non-deterministic part and is NOT covered by the signature. SSRF-guarded; the crawl is bounded at every axis. — $0.01/call
- `table`: URL in → the page's main HTML