ToolMint Dependency Migration
npm/PyPI upgrade delta: curated playbooks + changelog/release heuristics. Not a full Actor/LLM upgrade agent.
Public data and developer checks, shaped for AI agents: one HTTP call, one small USDC payment, one predictable JSON answer with its sources. No account and no API key. If a call fails, you are not charged.
402 Payment Required with a PAYMENT-REQUIRED header: price, asset, network and payee.PAYMENT-SIGNATURE header.Full payment guide · llms.txt for agents · /.well-known/x402 discovery manifest · catalog.json
These answer today. Call one with no payment and you get an HTTP 402 with the exact price.
npm/PyPI upgrade delta: curated playbooks + changelog/release heuristics. Not a full Actor/LLM upgrade agent.
Static risk scanner for agent skills / MCP docs / npm package meta. Heuristic rules — not a sandbox. No local directory scan on Workers.
Normalize OpenAPI 3 / Swagger 2 specs from URL or posted text into a flat operations pack. SSRF-guarded https fetch.
npm/PyPI trust pack: registry facts + OSV vulns + typosquat neighbors in one call.
Search and fetch US Federal Register documents (public API). Includes open-comment fields.
US National Weather Service active alerts as clean JSON — by state/area or lat/lon. No NWS API key.
Code of Federal Regulations sections and their change history as clean agent JSON (eCFR + Federal Register APIs). No API key.
City code-enforcement cases for a street address as clean agent JSON: open/closed status, case type, dates, result, coordinates and a link to the city record. Each city's dataset license is recorded and returned.
Query USGS earthquake.usgs.gov FDSN/GeoJSON by point+radius, bbox, or near-me summary. Normalized events with felt/tsunami flags. Public domain US government data.
Built and tested, not deployed yet. Routes, prices and OpenAPI below come from the code; they can change before launch.
Read-only Base ERC-20 risk heuristics: contract verified (Blockscout), proxy/upgradeability (EIP-1967 slots), owner renounced, mint/pause/blacklist bytecode selectors (proxy + implementation), top-holder concentration…
Live crypto/USDC bounties, grants, hackathons and bug bounties from public sources, as one clean JSON list.
CISA Known Exploited Vulnerabilities catalog for agents — lookup by CVE, search by vendor/product/date, batch-check up to 50 CVEs. Returns due dates and ransomware-use flags. Public domain US government data.
One call per dependency: package trust + vulnerabilities at that version (OSV, CISA KEV, FIRST EPSS, fix version) + license obligations. For coding and DevSec agents deciding whether to add or upgrade a package.
Exported-API deltas between npm versions from published TypeScript declarations, for coding agents planning upgrades.
Check whether a domain or link looks legit before an agent acts: RDAP registration (IANA bootstrap), DNS via Cloudflare DoH (A/AAAA/MX/TXT + SPF/DMARC), TLS from crt.sh CT, redirect probe, newly-registered/suspicious…
Live, read-only health check of a public remote MCP endpoint: reachability and TLS, Streamable HTTP initialize, negotiated protocol version, tools/list schema sanity, tool-description safety flags, auth and x402 (paid…
Lint any x402 endpoint the way buyer agents and Bazaar catalogs see it: unpaid probe, decoded 402, accepts/bazaar/well-known/openapi checks, scored fix list (GET /check?url=https://...)
One call per CFR section: current regulation text (eCFR), how and when it changed (with the Federal Register rules behind each change), and proposed rules for its part that are still open for comment. For compliance…
US public-company brief: SEC EDGAR identity + recent filings + Federal Register quoted-phrase search in one call.
EIN → is it a real, exempt, deductible nonprofit? From IRS bulk files (EO BMF, Pub 78, automatic revocations). No API key, no upstream call at request time.
US federal contract opportunities from SAM.gov as clean agent JSON — filter by keyword, NAICS, state, posted dates. Provenance + terms on every paid response.
US Treasury Fiscal Data (average interest rates, exchange rates, debt to the penny) + daily Treasury yield curve + BLS CPI — one normalized JSON feed for AI agents. No API keys.
Who won US federal money: contracts, IDVs, grants and loans from USAspending.gov as clean agent JSON — filter by keyword, recipient, agency, NAICS, state, dates, amount. Provenance + terms on every paid response.
American Community Survey 5-year housing and economic indicators (median income, rent, home value, rent burden, tenure, vacancy, poverty, unemployment, education) for a state, county, tract or ZCTA, with margins of…
US address or lat/lon → Census FIPS geographies as clean JSON. No Census API key.
Send the property distress signals you already hold; get a transparent 0-100 score, tier, confidence and reasons. Pure compute: ToolMint brings no data, stores nothing, contacts no one.
HUD Fair Market Rents and Income Limits by US county as clean agent JSON. Attribution, terms and provenance on every paid response.
One call per US address: Census geocode + FEMA flood zone + NWS alerts + USGS quakes (address-risk-bundle), HUD Fair Market Rents and Income Limits for the county, and ACS 5-year demographics for the county and tract.…
Clean owner/contact records in one call: normalized names, owner type (individual/entity/trust/estate/government) with the matched keyword, offline USPS-style address formatting with issue flags, mailing-vs-property…
Is this reference real? DOI / arXiv / title / free-text citation → found, canonical metadata (Crossref, arXiv), field-by-field mismatches and retraction flags. Metadata only, never abstracts.
Clinical trial search and lookup from ClinicalTrials.gov as flat agent JSON: status, phase, sponsor, sites, and eligibility split into inclusion/exclusion lists. Provenance + attribution on every paid response. No…
US healthcare provider verification: NPI check digit + NPPES record + HHS-OIG LEIE exclusion screen, as clean agent JSON. No API key.
US patent applications and grants from the USPTO Open Data Portal as flat agent JSON: search by words, title, applicant, inventor, CPC and dates, or look one up by application or patent number. Provenance + attribution…
One paid call for US location risk: Census geocoder → county/tract, active NWS weather alerts, nearby USGS earthquakes, and FEMA NFHL flood zone. Useful for insurance, logistics, events, travel and real-estate…
vPIC VIN decode + the NHTSA recall campaigns and complaint summary for that make/model/year in one call — normalized, deduped, risk flags. Not a per-VIN open-recall check. Errors and no-match return 4xx/5xx and are not…
Decode a US VIN with NHTSA vPIC and return the NHTSA recall campaigns (and optional complaints) for that make/model/year. Not a per-VIN open/unrepaired status check. US Government data (public domain), no API key.…
FDA food, drug and device recall/enforcement lookups via openFDA — normalized, deduped, Class I/II/III explained. Not for clinical use.
Local MCP / CLI tools. Paid hosted versions are not wired up yet; docs describe the current code.
"Turn this HTML / CSV / JSON / PDF into the format my agent can use, and pull the tables out as JSON."
"Does this vendor's public status page say they are up right now?" You give a provider id; you get one JSON object with an overall state, a short description, up to 40 components and up to 10 incidents.
"What is this host's crawl and AI-training policy right now (robots.txt, llms.txt, ai.txt, TDM headers), and has it changed between the snapshots we have on record?"
"For this URL, what do the site's robots.txt, llms.txt and ai.txt say, and may AI crawlers such as GPTBot, ClaudeBot or CCBot fetch this path?"
"What licence does this npm or PyPI package declare, and what does that licence roughly require (keep notices, share source, and so on)?" It can also take a list of package names and flag the ones with copyleft licences.
"Between these two versions of an agent memory file, what lines and sections changed, how much churn is there, and did anything credential-like change?"
"Has the text of this public page (or one part of it) changed since I last looked?" The first call stores a baseline. Each later call fetches the page again and reports changed or not, which lines were added or removed…
"Give me the text of this PDF, Word, PowerPoint or Excel file as clean Markdown, plus pages, headings, tables and counts as JSON."
Did a pricing page or terms page change?
"Does this skill or instruction text contain patterns that often mean trouble?" You send the text. You get a list of findings (each with an id, a severity, a short tip and the matching text) and a grade from A to F.
One merged record for a CVE or a package version
"Which Federal Register documents on this topic have a public comment period that has not closed yet, when does each close, and where do I comment?"
SEC EDGAR data as clean JSON
"Give me Item 1A (Risk Factors) of Apple's latest 10-K as text," or "list the tables in Microsoft's latest 10-Q," or "give me the tagged numbers (inline XBRL) in this filing."
"What jobs does this company have open on its public Greenhouse or Lever job board?" Optionally filtered by a keyword in the title, location or team.
"What is in this feed, and what is new since I last asked?" You give a feed URL. You get the items in one JSON shape (title, link, id, date, short preview, content hash) and a list of items whose hash you have not seen…