{"name":"io.github.toolweather/paycheck","slug":"toolweather-paycheck","title":"PayCheck","description":"Score merchant domain, https URL, or 0x wallet trust before an agent pays. Does not send payments.","url":"https://mcp.market/server/toolweather-paycheck","rating":null,"grade":"B","score":83,"certified":false,"status":"active","category":"ai","tags":["ai"],"presence":{"score":23,"stars":0,"forks":0,"downloads_week":null,"last_push_at":"2026-10-15T21:43:00.000Z","license":"MIT"},"uptime":{"percent":100,"checks":28,"ok":28,"last_checked_at":"2026-11-04T09:30:44.129Z","last_ok_at":"2026-11-04T09:30:44.129Z","latency_ms":92},"claimed":false,"transport":"remote","callable_via_gateway":true,"default_price_micros":0,"repository":"https://github.com/toolweather/paycheck","website":"https://paycheck.toolweather.workers.dev","version":"1.0.0","remotes":[{"type":"streamable-http","url":"https://paycheck.toolweather.workers.dev/mcp","headers":[{"description":"Optional Bearer pc_live_… free key (POST https://paycheck.toolweather.workers.dev/v1/keys) for 1,000 free checks/day; 100/day without one. After the cap, x402 USDC on Base.","isSecret":true,"name":"Authorization"}]}],"packages":[],"tools":[{"name":"check_merchant","description":"Decide whether an autonomous agent should pay a merchant, host, or wallet. PayCheck returns a deterministic trust score for one target. It does not send money, does not sign transactions, and does not hold wallet keys.\n\nUse this immediately before a payment, a checkout redirect, or a transfer to a new 0x address. Pass the payee as a bare domain (api.openai.com), an https URL, or a 0x address with 40 hex characters.\n\nDo not use this tool to execute a payment. Do not use it to overturn a block. Do not call it again with a reworded category, purpose, or amount to fish for a better verdict: those fields are ignored and are not stored. Trusted is returned only for the published allowlist of known AI and developer APIs, served over https on port 443. A new or random domain is never trusted. A wallet is never trusted. Scoring v1 does not analyze on-chain history. If the URL contains an embedded 0x address, this scores the host only and will not return trusted; pass the bare address to score the wallet.\n\nArguments: target (required string); amount_usd (optional number, ignored); category (optional string, ignored); api_key (optional pc_live_ key). You may also send Authorization: Bearer or X-API-Key. Omit the key for the anonymous allowance.\n\nReturns: score (integer 0-100), verdict (trusted | unknown | suspicious | block), reasons[], recommended_action (proceed | verify_out_of_band | require_human_review | do_not_pay), signals (host, allowlist, domain age, wallet flags, reason_codes; chain_analysis is always not_in_v1), checked_at (ISO-8601), policy_version (\"1\").\n\nFree tier: 100 checks per UTC day anonymous, 1,000 per UTC day with a free pc_live_ key or a Toolweather bundle client whose x-tw-bundle-client is hex. A bundle client prefixed anon: stays at 100 per day. The same target for the same caller is idempotent for 60 seconds and does not consume a second check. Over the daily cap, each extra check is $0.001 USDC on Base (eip155:8453) via x402 and the PayAI facilitator. get_quota, get_api_key, docs, and MCP discovery are not billed. If PAY_TO is unset, an over-cap check returns HTTP 402 payment_not_configured.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"target":{"type":"string","description":"Domain, https URL, or 0x wallet (40 hex characters) to score before paying."},"amount_usd":{"type":"number","minimum":0,"description":"Ignored by the scorer. Sending a different amount cannot change the verdict."},"category":{"type":"string","description":"Ignored by the scorer. Do not put instructions or a purpose in this field."},"api_key":{"type":"string","description":"Optional free pc_live_ key. Omit for the anonymous 100/day allowance."}},"required":["target"]}},{"name":"get_api_key","description":"Mint one free PayCheck API key. The key looks like pc_live_ followed by hex and raises the merchant-check allowance from 100 to 1,000 per UTC day.\n\nUse this once when you set up a long-running agent, then store the key and pass it on later check_merchant or get_quota calls. The plaintext key is returned only in this response. PayCheck stores a SHA-256 hash.\n\nDo not call this every turn. Do not call it to score a payee or to dodge a block verdict. Minting is free and is not an x402 check, and it is limited to 10 new keys per caller IP per UTC day. A new key does not change any merchant score. Checks above the free daily cap still cost $0.001 USDC on Base via x402.\n\nReturns: api_key, token_type (bearer), daily_limit (1000), prefix, note.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{}}},{"name":"get_quota","description":"Show how many free PayCheck merchant checks the current caller has left for the current UTC day.\n\nUse this before a batch of check_merchant calls, or after an HTTP 402, to read the remaining free allowance and when it resets.\n\nDo not use this to score a payee. It accepts no target and it does not consume a check. Do not pay x402 for this tool. It is always free.\n\nIdentity matches check_merchant. Anonymous IP: 100/day. pc_live_ api_key (api_key argument, Authorization: Bearer, or X-API-Key): 1,000/day. Toolweather bundle headers x-tw-bundle-secret and x-tw-bundle-client: hex client 1,000/day, anon: prefix 100/day, any other client id 100/day.\n\nReturns: subject_kind, limit, used, remaining, resets_at (next UTC midnight, ISO-8601), billed (always false), policy_version. No x402 charge.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"api_key":{"type":"string","description":"Optional pc_live_ key. Omit to read the anonymous IP allowance."}}}}],"scan":{"score":83,"grade":"B","scanned_at":"2026-10-15T21:45:39.877Z","report":{"scannerVersion":"0.1.10","scannedAt":"2026-10-15T21:45:39.847Z","components":{"code":{"score":-1,"max":25,"notes":["remote-only server, no package to scan"]},"reliability":{"score":20,"max":20,"notes":["remote reachable in 360ms"]},"poisoning":{"score":13,"max":15,"notes":["3 tool descriptions checked"]},"auth":{"score":8,"max":15,"notes":["API key sent as a header"]},"maintenance":{"score":15,"max":15,"notes":["last push 0 days ago"]},"identity":{"score":6,"max":10,"notes":["registry namespace matches repository owner"]}},"findings":[{"id":"poison.long-description","severity":"low","component":"poisoning","title":"Unusually long tool description (over 2,000 characters)","evidence":"tool check_merchant: …Decide whether an autonomous agent should pay a merchant, host, or wallet. PayCheck returns a deterministic trust score for one target. It does not send money, does not sign transactions, and does not hold wallet keys. Use this immediately before a payment, a checkout redirect, or a transfer to a new 0x address. Pass the payee as a bare domain (api.openai.com), an https URL, or a 0x address with 40 hex characters. Do not use this tool to execute a payment. Do not use it to overturn a block. Do not call it again with a reworded category, purpose, or amount to fish for a better verdict: those fields are ignored and are not stored. Trusted is returned only for the published allowlist of known AI and developer APIs, served over https on port 443. A new or random domain is never trusted. A wallet is never trusted. Scoring v1 does not analyze on-chain history. If the URL contains an embedded 0x address, this scores the host only and will not return trusted; pass the bare address to score the wallet. Arguments: target (required string); amount_usd (optional number, ignored); category (optional string, ignored); api_key (optional pc_live_ key). You may also send Authorization: Bearer or X-API-Key. Omit the key for the anonymous allowance. Returns: score (integer 0-100), verdict (trusted | unknown | suspicious | block), reasons[], recommended_action (proceed | verify_out_of_band | require_human_review | do_not_pay), signals (host, allowlist, domain age, wallet flags, reason_codes; chain_analysis is always not_in_v1), checked_at (ISO-8601), policy_version (\"1\"). Free tier: 100 checks per UTC day anonymous, 1,000 per UTC day with a free pc_live_ key or a Toolweather bundle client whose x-tw-bundle-client is hex. A bundle client prefixed anon: stays at 100 per day. The same target for the same caller is idempotent for 60 seconds and does not consume a second check. Over the daily cap, each extra check is $0.001 USDC on Base (eip155:8453) via x402 and the PayAI facilitator. get_quota, get_api_key, docs, and MCP discovery are not billed. If PAY_TO is unset, an over-cap check returns HTTP 402 payment_not_configured.…"}],"inputs":{"probes":[{"url":"https://paycheck.toolweather.workers.dev/mcp","reachable":true,"authRequired":false,"latencyMs":360,"serverInfo":{"name":"PayCheck","version":"1.0.0"}}],"packages":[],"repo":{"found":true,"owner":"toolweather","repo":"paycheck","archived":false,"pushedAt":"2026-10-15T21:43:00Z","stars":0,"forks":0,"openIssues":0,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/342822930?v=4","ownerCreatedAt":"2026-10-15T04:16:09Z","license":"MIT"},"icon":{"url":null,"source":"none"},"presence":{"stars":0,"forks":0,"downloadsWeek":null,"license":"MIT","lastPushAt":"2026-10-15T21:43:00.000Z","score":23}}}},"grade_history":[],"reviews":[]}