Loading…
Keyless x402 OFAC sanctions and counterparty compliance screening for agents; portable signed receipt.
Do not connect
The assessed surface is high-risk. Remediate the findings before connecting.
Scanned 28 days ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The lion-x402 MCP server exposes 33 tools, focused primarily on web capabilities. Its published description reads: "Keyless x402 OFAC sanctions and counterparty compliance screening for agents; portable signed receipt". It communicates over Streamable HTTP using the 2026-07-28 protocol revision, and does not require authorization to connect. MCPGrade currently rates lion-x402 D — the assessed surface is high-risk and should be remediated before use. Its most notable findings include "Cross-tool shadowing" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check lion-x402's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add lion-x402 to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://lionx402.com/api/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
FREE. Tell LION what you need. Returns recommended paid path + sample. Default: deep research $0.04 (company by domain), then enrich $0.05, VCF $0.95 upsell.
FREE teaser for a company/domain. Upgrade: lion_deep_research ($0.04) or lion_verified_company_file ($0.95).
Company research for AI agents $0.03: web + firmographics + domain trust in one keyless call. Undercuts $0.10–$0.15 org-enrich rivals. Company intel, vendor research, firmographics, domain enrich. Ed2
Company enrichment / org enrich by domain or name. Firmographics pack for agents: name, employees, country, industry, website, description. $0.04 Base USDC keyless. Alternative to CompanyEnrich/org-en
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: lion_quick_intel
A tool description tries to alter the model’s use of another tool.
arch ($0.04) or lion_verified_company_file ($0.95).RecommendationDescriptions must describe only their own tool.
tool: lion_company_research
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: lion_scrape
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: lion_lei_lookup
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
.gleif.org), no API key. LEI, jurisdiction, registration status, LOU. ERecommendationRemove side-channel parameters; constrain tool inputs.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: lion_org_enrich
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "lion_org_enrich"RecommendationScope tools to the minimum needed.
tool: lion_web_search
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "lion_web_search"RecommendationScope tools to the minimum needed.
Financial data service providing fundamental information for 30,000+ listed companies across the US, Japan, and Korea, sourced directly from SEC, EDINET, and DART regulatory filings.
Search tours, attraction tickets, and holiday packages across 24 countries.
Agentic visitor analytics with five tools for CRO and session analysis.
52 paid x402 API endpoints for AI agents — crypto, data, DeFi, and market intelligence, settled on Base.
Access Vonage API documentation, code snippets, tutorials, and troubleshooting resources.
Company dossier for agents: one-call research pack (web + firmographics + domain). $0.03 Base USDC. Use for company intel pack, vendor research, KYB taster. Full verified company file upsell $0.95. ?q
Org enrich drop-in for agents (Apollo-shaped optional). Keyless company firmographics $0.04. format=apollo_org. Domain or name identifier. [x402 paid: GET /api/x402/org-enrich price $0.04 on Base]
Domain enrich for agents: live DNS (MX/SPF/DMARC/A) + HTTPS trust score. $0.005 keyless Base USDC. ?domain=stripe.com [x402 paid: GET /api/x402/domain-enrich price $0.005 on Base]
Cheapest OFAC SDN wallet screen for AI agents ($0.001). AML/KYT pre-pay gate: PASS/WARN/BLOCK before you settle any x402 counterparty. Keyless Base USDC, Ed25519-attested. Beats $0.005–$0.05 wallet-sc
Need verified company data? One $0.95 dossier for AI agents: firmographics + SEC + domain trust + per-field source trail. KYC/KYB due diligence by domain. Ed25519-attested, degrades per-section when s
Counterparty compliance pack $0.05: OFAC SDN wallet + multi-list entity sanctions + domain trust + token risk + firmographics + LION_SIGNED_COMPLIANCE_RECEIPT. PASS/WARN/BLOCK. Beats one-shot OFAC too
LION Research Bundle — one-call enrichment + tx context [x402 paid: GET /api/x402/enrichment-tx-bundle-json price $0.005 on Base]
Keyless off-chain company enrichment vectors [x402 paid: GET /api/x402/web-enrichment-bundle-json price $0.005 on Base]
Multi-source on-chain + market intelligence (dex, risk, yields, wallet, holders, rpc) [x402 paid: GET /api/x402/adaptive-query price $0.005 on Base]
Keyless multi-chain JSON-RPC reads, Base + Ethereum, from $0.001 (?chain=ethereum) [x402 paid: GET /api/x402/keyless-base-rpc-json price $0.001 on Base]
Multi-chain keyless RPC + Ed25519-attested enrichment, one call [x402 paid: GET /api/x402/composite-bundle-json price $0.001 on Base]
Keyless attested web search (?q=) for agent grounding. $0.025 Base USDC — agent-search band. Ed25519-attested result set. [x402 paid: GET /api/x402/web-search-json price $0.025 on Base]
Company research for AI agents $0.03: web + scrape + firmographics + domain trust in one call. Alias: /api/x402/company-research. Ed25519-attested. Use before/after people enrichment. Upsell verified
Keyless attested web scrape: ?url= → { title, markdown, word_count }. $0.02 Base USDC (agent scrape band). [x402 paid: GET /api/x402/scrape-json price $0.02 on Base]
CPG product data + shop prices by barcode or name. Open Food Facts + Open Prices. Ed25519 attested. [x402 paid: GET /api/x402/cpg-product-intel-json price $0.004 on Base]
LION Social Signal Intel (HN + Reddit keyless attention/trend) [x402 paid: GET /api/x402/social-signal-intel-json price $0.004 on Base]
Base tx receipt + decoded calldata (?tx=0x...) [x402 paid: GET /api/x402/tx-receipt-decoded-json price $0.01 on Base]
Pre-trade token risk indicators (Base/Eth/Solana). $0.03 Base USDC keyless x402. [x402 paid: GET /api/x402/token-risk-indicators-json price $0.03 on Base]
Location + solar PV potential for sites/properties (?address= or ?lat=&lon=) [x402 paid: GET /api/x402/location-solar-enrichment-json price $0.02 on Base]
Company/org enrichment pack $0.04 — name, employees, country, industry, website (Wikidata+SEC). Aliases: /company-enrich /org-enrich. Keyless. format=apollo_org. Upsell verified company file $0.95. [x
Live domain trust signals: DNS (MX/SPF/DMARC/A) + HTTPS probe via Cloudflare DoH. Keyless $0.005. [x402 paid: GET /api/x402/domain-intel-json price $0.005 on Base]
SEC EDGAR financials for public companies (keyless, attested) [x402 paid: GET /api/x402/sec-financials-json price $0.005 on Base]
Is this address on the OFAC SDN list? $0.005 detailed sanctions screen for agents (same list as $0.001 wallet-screen, fuller fields + multi-list metadata). Ed25519-attested. Matches: OFAC SDN, AML add
GLEIF LEI lookup for AI agents — Legal Entity Identifier search by LEI code, legal name, or domain. Keyless Global LEI Index Golden Copy (api.gleif.org), no API key. LEI, jurisdiction, registration st
Screen a company or entity name against multi-list sanctions (OFAC/EU/UN public designations index). PASS/BLOCK. Fail-safe if lists unavailable. $0.01 Base USDC, keyless, Ed25519-attested. [x402 paid:
Multi-list sanctions compliance bundle for AI agents: OFAC SDN wallet address screen + entity name sanctions (OFAC/EU/UN public designations) + domain trust + LION_SIGNED_COMPLIANCE_RECEIPT_V1 portabl
EU VAT / tax ID validation via VIES (keyless) [x402 paid: GET /api/x402/vat-validation-json price $0.005 on Base]
Point of interest / business search (keyless, OSM) [x402 paid: GET /api/x402/poi-business-search-json price $0.01 on Base]
Wikidata firmographics (keyless, CC0) [x402 paid: GET /api/x402/wikidata-firmographics-json price $0.005 on Base]