Search / io.github.toolweather/paycheck
protogridR0· no sign-inScore merchant domain, https URL, or 0x wallet trust before an agent pays. Does not send payments.
v1.0.0 · active · repository · website · descriptor JSON · versions
{
"mcpServers": {
"paycheck": {
"type": "http",
"url": "https://paycheck.toolweather.workers.dev/mcp",
"headers": {
"Authorization": "Bearer ${PAYCHECK_TOKEN}"
}
}
}
}claude mcp add --transport http paycheck https://paycheck.toolweather.workers.dev/mcp --header "Authorization: Bearer ${PAYCHECK_TOKEN}"[mcp_servers.paycheck]
url = "https://paycheck.toolweather.workers.dev/mcp"
bearer_token_env_var = "PAYCHECK_TOKEN"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"paycheck": {
"type": "remote",
"url": "https://paycheck.toolweather.workers.dev/mcp",
"enabled": true,
"headers": {
"Authorization": "Bearer {env:PAYCHECK_TOKEN}"
}
}
}
}{
"mcpServers": {
"paycheck": {
"type": "http",
"url": "https://paycheck.toolweather.workers.dev/mcp",
"headers": {
"Authorization": "Bearer ${PAYCHECK_TOKEN}"
}
}
},
"deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=paycheck&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vcGF5Y2hlY2sudG9vbHdlYXRoZXIud29ya2Vycy5kZXYvbWNwIiwiaGVhZGVycyI6eyJBdXRob3JpemF0aW9uIjoiQmVhcmVyICR7UEFZQ0hFQ0tfVE9LRU59In19"
}{
"servers": {
"paycheck": {
"type": "http",
"url": "https://paycheck.toolweather.workers.dev/mcp",
"headers": {
"Authorization": "Bearer ${PAYCHECK_TOKEN}"
}
}
}
}{
"mcpServers": {
"paycheck": {
"httpUrl": "https://paycheck.toolweather.workers.dev/mcp",
"headers": {
"Authorization": "Bearer ${PAYCHECK_TOKEN}"
}
}
}
}extensions:
"paycheck":
enabled: true
name: "paycheck"
type: streamable_http
uri: "https://paycheck.toolweather.workers.dev/mcp"
headers:
"Authorization": "Bearer ${PAYCHECK_TOKEN}"
timeout: 300
Placeholders to fill from your own secret store: ${PAYCHECK_TOKEN}. The registry never accepts secret values.
protocol.modernnewest supported version is 2025-06-18; 2026-07-28 not supported, older versions are deprecated until 2027-07-28protocol.statelessonly applies to 2026-07-28 serversprotocol.transportstreamable HTTPprotocol.list_ttlonly applies to 2026-07-28 serversauth.prm, auth.as_metadata, auth.cimdno remote uses OAuthauth.secret_in_urlno templated URLtools.descriptionsevery tool has a descriptiontools.description_length1 tools have descriptions over 1,024 characters, which crowds the contexttools.schemasevery tool has an object input schematools.annotations3 of 3 tools declare readOnlyHint or destructiveHinttools.directory_hintsevery tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHinttools.token_costabout 1,192 tokens to load every tooltools.api_dumptools are not a one-to-one API dumpstability.changes, stability.rug_pulltool history recorded for 3 of the 7 days neededdeps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI packageNo tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
+repository +namespace-matches-repo +website +reachable +uptime-100% +updated-4d-ago
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
| remote | auth | reachable | uptime 30d | p50 | protocol | last ok |
|---|---|---|---|---|---|---|
https://paycheck.toolweather.workers.dev/mcp streamable-http | none | yes | 100% | 157 ms | 2025-06-18 | 2026-10-19 |
check_merchant | Decide whether an autonomous agent should pay a merchant, host, or wallet. PayCheck returns a deterministic trust score for one target. It does not send money, does not sign transactions, and does not hold wallet keys. Use this immediately before a payment, a checkout redirect, or a transfer to a new 0x address. Pass the payee as a bare domain (api.openai.com), an https URL, or a 0x address with 40 hex characters. Do not use this tool to execute a payment. Do not use it to overturn a block. Do not call it again with a reworded category, purpose, or amount to fish for a better verdict: those fields are ignored and are not stored. Trusted is returned only for the published allowlist of known AI and developer APIs, served over https on port 443. A new or random domain is never trusted. A wallet is never trusted. Scoring v1 does not analyze on-chain history. If the URL contains an embedded 0x address, this scores the host only and will not return trusted; pass the bare address to score the wallet. Arguments: target (required string); amount_usd (optional number, ignored); category (optional string, ignored); api_key (optional pc_live_ key). You may also send Authorization: Bearer or X-API-Key. Omit the key for the anonymous allowance. Returns: score (integer 0-100), verdict (trusted | unknown | suspicious | block), reasons[], recommended_action (proceed | verify_out_of_band | require_human_review | do_not_pay), signals (host, allowlist, domain age, wallet flags, reason_codes; chain_analysis is always not_in_v1), checked_at (ISO-8601), policy_version ("1"). Free tier: 100 checks per UTC day anonymous, 1,000 per UTC day with a free pc_live_ key or a Toolweather bundle client whose x-tw-bundle-client is hex. A bundle client prefixed anon: stays at 100 per day. The same target for the same caller is idempotent for 60 seconds and does not consume a second check. Over the daily cap, each extra check is $0.001 USDC on Base (eip155:8453) via x402 and the PayAI facilitator. get_quota, get_api_key, docs, and MCP discovery are not billed. If PAY_TO is unset, an over-cap check returns HTTP 402 payment_not_configured. |
get_api_key | Mint one free PayCheck API key. The key looks like pc_live_ followed by hex and raises the merchant-check allowance from 100 to 1,000 per UTC day. Use this once when you set up a long-running agent, then store the key and pass it on later check_merchant or get_quota calls. The plaintext key is returned only in this response. PayCheck stores a SHA-256 hash. Do not call this every turn. Do not call it to score a payee or to dodge a block verdict. Minting is free and is not an x402 check, and it is limited to 10 new keys per caller IP per UTC day. A new key does not change any merchant score. Checks above the free daily cap still cost $0.001 USDC on Base via x402. Returns: api_key, token_type (bearer), daily_limit (1000), prefix, note. |
get_quotaread-only | Show how many free PayCheck merchant checks the current caller has left for the current UTC day. Use this before a batch of check_merchant calls, or after an HTTP 402, to read the remaining free allowance and when it resets. Do not use this to score a payee. It accepts no target and it does not consume a check. Do not pay x402 for this tool. It is always free. Identity matches check_merchant. Anonymous IP: 100/day. pc_live_ api_key (api_key argument, Authorization: Bearer, or X-API-Key): 1,000/day. Toolweather bundle headers x-tw-bundle-secret and x-tw-bundle-client: hex client 1,000/day, anon: prefix 100/day, any other client id 100/day. Returns: subject_kind, limit, used, remaining, resets_at (next UTC midnight, ISO-8601), billed (always false), policy_version. No x402 charge. |
Schemas: list_tools.
{
"name": "io.github.toolweather/paycheck",
"title": "PayCheck",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"remotes": [
{
"url": "https://paycheck.toolweather.workers.dev/mcp",
"type": "streamable-http",
"headers": [
{
"name": "Authorization",
"isSecret": true,
"description": "Optional Bearer pc_live_… free key (POST https://paycheck.toolweather.workers.dev/v1/keys) for 1,000 free checks/day; 100/day without one. After the cap, x402 USDC on Base."
}
]
}
],
"version": "1.0.0",
"repository": {
"url": "https://github.com/toolweather/paycheck",
"source": "github"
},
"websiteUrl": "https://paycheck.toolweather.workers.dev",
"description": "Score merchant domain, https URL, or 0x wallet trust before an agent pays. Does not send payments."
}