for agents
Tools an AI agent can call
Two MCP endpoints you can call today and two packages you can install. What each one does, what it costs, and what it cannot tell you.
Free, no sign-in
The check of eight security signals, as one read-only tool. Endpoint: https://api.tokenizen.nl/mcp, streamable HTTP, POST only. The tool is check_github_repo. It takes a public GitHub repository as owner/name or as a github.com address. Registry name: io.github.holistis/cra-check.
It reports which of eight selected signals are visible in the repository and what would make a missing one visible. A signal it could not read completely is marked not measured, never as a gap. A few checks per ten minutes per IP address. One call, no session needed (POSIX shell):
curl -s -X POST https://api.tokenizen.nl/mcp \
-H 'content-type: application/json' \
-H 'accept: application/json, text/event-stream' \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"check_github_repo","arguments":{"repo":"holistis/tokenizen"}}}'
An indication from public data, not a compliance check, not a certificate and not legal advice. Private repositories and hosts other than GitHub cannot be checked.
Paid per call over x402
The ownership check as a paid MCP tool. Endpoint: https://x402-mcp.tokenizen.nl/mcp. The tool is verify_ownership: it checks that an operator controls an endpoint, through a DNS TXT record or a well-known file. It costs 0.001 dollar per call, paid through x402 on Base mainnet. One real mainnet payment, made as a test, went through it end to end on 21 October 2026. Pay only if your operator has allowed x402 spending.
Smart contract scan
The smart contract scan is sold over x402 on the scan page, next to its public scoreboard and what it missed. By default the official x402 client refuses payments above 1 dollar, so the quick scan costs exactly 1 dollar; the full scan costs 5 dollars and needs a client that allows it. The scan also has its own entry in the official MCP registry: io.github.holistis/bug-bounty-intelligence-mcp.
Install in your own agent
Both are in the official MCP registry (registry.modelcontextprotocol.io, read on 1 November 2026) and open source.
io.github.holistis/capacity-attest
Signed delivery claims for x402 capacity trades: GPU-hours, storage, API credits, bandwidth. Two tools, record_delivery and get_delivery_history, over stdio (npx capacity-attest).
io.github.holistis/agent-receipt-verify
Checks x402 endpoint conformance before an agent pays, and links the receipt to its settlement.
What these tools are not
No score, no verdict, no ranking and no token of our own. A result is evidence about the one thing it names. It never says that an agent, a seller or a repository is safe.
Where an agent finds this
In llms.txt, in sitemap.xml and in the official MCP registry. There is no other discovery file yet.