# com.apiacre/api-acre

73 x402-paid Base and Solana APIs with free discovery, samples, workflows, and Pixel Acre.

- **Type:** MCP server
- **Trust:** 60/100 (B), scored on the content rubric
- **Verification:** community-indexed — nobody has claimed this listing
- **Version:** 0.1.36
- **Author:** com.apiacre
- **License:** Unknown
- **Endpoints:** streamable-http https://apiacre.com/mcp
- **Source:** https://apiacre.com
- **Endpoint health:** reachable (last checked 2026-09-19T05:05:44.102Z, 4 samples) — uptime is not a security property and is not part of the trust score
- **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport)

## Trust

60/100 (B), scored on the content rubric
- Publisher verified: no
- Install scripts: nothing suspicious found
- Prompt-injection scan: clean
- Obfuscation scan: clean
- Evidence age: 0 days

## Security scan

- **Status:** clean
- **Scanned:** 2026-09-19T05:05:44.102Z
- **Version scanned:** live
- **CVEs:** no coverage — this entry has no package coordinates to query OSV against, so "no known CVEs" is NOT asserted for it.
**Findings**
- injection-shaped content (note) in the `data.current-weather` tool: Imperative addressed to the AI model

## Tools

73 declared. Observed from a live `tools/list` probe.
- `web.extract` — Convert and extract a public website URL into clean Markdown or readable text plus bounded structured links, canonical and heading signals, Schema.org types, re
- `web.metadata` — Extract webpage metadata from one public URL: page title, meta description, canonical URL, headings, hreflang, icons, feeds, Open Graph, Twitter Cards, and JSON
- `web.seo-audit` — Audit one public URL for title, meta description, H1 count, image alt text, canonical, robots, language, Open Graph, Twitter cards, headings, hreflang, feeds, a
- `web.security-audit` — Scan a public website for TLS and browser security header weaknesses and return a security score with fixes.
- `web.accessibility-audit` — Check a public page for deterministic HTML accessibility problems and return actionable WCAG-oriented findings.
- `web.performance-profile` — Measure website response latency, payload size, compression, caching, and performance signals for a public URL.
- `web.links` — Extract and classify links from one public page or safely crawl up to 10 same-origin pages into an agent-ready site map with page provenance, depth limits, and 
- `web.robots-sitemap` — Inspect a domain's robots.txt crawl rules and XML sitemap health, availability, and URL count.
- `web.tech-fingerprint` — Identify frameworks, analytics, CDNs, servers, and other website technologies from public response signals.
- `web.email-auth` — Check a public domain's email authentication and anti-spoofing posture using MX, SPF, DMARC, caller-selected DKIM, MTA-STS, TLS-RPT, and BIMI DNS evidence.
- `web.domain-intelligence` — Investigate a domain using parallel DNS, TLS certificate, RDAP (the standards-based successor to WHOIS), DNSSEC, SPF, and DMARC signals with factual findings an
- `web.full-audit` — Run a comprehensive website audit combining SEO, security, accessibility, and performance scores with prioritized fixes.
- `web.business-due-diligence` — Assess one public business website and domain using site quality, SEO, security, accessibility, performance, DNS, TLS, RDAP, and optional public GLEIF candidate
- `commerce.product-price` — Paste one public retailer product URL to get its current publisher-supplied structured price, currency, availability, seller, shipping terms, aggregate rating, 
- `research.lei-entity-search` — Search the official GLEIF Global LEI Index by exact LEI or legal name and return ranked legal-entity identity, registration, mapped-identifier, and relationship
- `document.extract` — Extract clean text and metadata from supplied PDF, DOCX, HTML, Markdown, CSV, JSON, YAML, or plain-text documents.
- `document.tables` — Extract structured table rows and columns from supplied HTML, DOCX, or CSV documents.
- `document.redact` — Deterministically detect and redact PII and personal data in supplied text with overlap-safe matching for emails, phone numbers, validated IPv4 and IPv6 address
- `document.diff` — Compare two texts and return structured line additions, removals, and a unified diff.
- `data.profile` — Profile CSV, TSV, JSON, JSON Lines, or YAML records for field types, nulls, uniqueness, and representative samples.
- `data.clean` — Clean CSV, TSV, JSON, JSON Lines, or YAML records with collision-safe header normalization, deterministic integrity hashes, and exact transformation counts.
- `data.convert` — Convert caller-supplied CSV, TSV, JSON, JSON Lines (NDJSON), or YAML with optional root preservation, deterministic integrity hashes, JSON-encoded nested tabula
- `data.json-repair` — Repair caller-supplied malformed JSON by safely removing an outer Markdown fence, comments, single-quoted strings, unquoted identifier keys, Python literals, an
- `data.schema` — Create and generate a nested JSON Schema Draft 2020-12 contract by inferring field types and required fields from representative JSON, CSV, TSV, JSON Lines, or 
- `data.schema-validate` — Validate JSON data against a bounded JSON Schema Draft 2020-12 contract for nested objects, arrays, required properties, types, enums, formats, lengths, pattern
- `data.contract` — Normalize caller-supplied CSV, TSV, JSON, JSON Lines, or YAML to deterministic JSON, infer a Draft 2020-12 schema from that normalized value, and validate one f
- `data.schemaorg-normalize` — Normalize caller-supplied inline Schema.org JSON-LD into deterministic Organization, Product, Service, Article, and Event entities with privacy scrubbing and fi
- `data.deduplicate` — Remove duplicate CSV, TSV, JSON, JSON Lines, or YAML records using selected identity fields and report the removed count.
- `developer.x402-preflight` — Probe a public endpoint without paying, grade its x402 v2 challenge, check exact-host x402-list presence and traction, and optionally rank licensed market match
- `developer.openapi-audit` — Validate and audit an OpenAPI document for missing operation IDs, descriptions, responses, and consistency problems.
- `developer.dependency-audit` — Audit exact Python/PyPI, npm, Go, Maven, NuGet, crates.io, or RubyGems dependencies against OSV and return affected packages and vulnerabilities.
- `developer.license-audit` — Classify software dependency licenses and flag packages that need commercial or legal review.
- `developer.secret-scan` — Detect likely leaked API keys, tokens, private-key headers, JWTs, and credential assignments in caller-supplied source or configuration text. Return type, line,
- `developer.code-metrics` — Measure caller-supplied source code with Python AST analysis or a deterministic lexical fallback, including per-function complexity, a SHA-256 fingerprint, dens
- `developer.code-change-review` — Compare caller-supplied before and after source snapshots without execution or network access, returning source fingerprints, syntax regressions, structural del
- `developer.sql-change-review` — Statically parse caller-supplied SQL without a database connection or execution, inventory statements and tables, and flag destructive DDL, unfiltered writes, a
- `developer.structured-diff` — Compare JSON or YAML deterministically and return source hashes plus machine-readable additions, removals, and replacements by path with explicit truncation evi
- `research.feed-normalize` — Fetch and normalize public RSS or Atom feeds into stable structured JSON entries for agents and research workflows.
- `research.news-aggregate` — Merge two to eight public RSS or Atom feeds into a filtered, deduplicated, time-ordered news stream with bounded partial-failure reporting.
- `developer.openapi-test-generate` — Generate deterministic, syntax-validated pytest and requests smoke tests from a caller-supplied OpenAPI 3 document, with mutating operations disabled by default
- …and 33 more

## Install

**Verdict: review** — Installable, but 2 things to check first: No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it.
**Cautions** (coverage gaps and advisories — never blocking)
- No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it.
- No publisher has proved control of this listing; it is indexed, not vouched for.
**Config** (claude-code):
```json
"{\n  \"mcpServers\": {\n    \"api-acre\": {\n      \"type\": \"http\",\n      \"url\": \"https://apiacre.com/mcp\"\n    }\n  }\n}"
```

## Blast radius

Contained to moderate — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: runs on someone else's infrastructure; read-only tool surface.
- Floor 9, ceiling 27 (tier: unknown)
- `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low.
- This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score.

## Machine-readable views of this entry

- Signed JSON: https://forgeregistry.com/api/v1/packages/com.apiacre%2Fapi-acre
- Install plan: https://forgeregistry.com/api/v1/packages/com.apiacre%2Fapi-acre/install-plan
- Alternatives: https://forgeregistry.com/api/v1/alternatives/com.apiacre%2Fapi-acre
- HTML page: https://forgeregistry.com/registry/com.apiacre%2Fapi-acre
- MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan`

## About this document

Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.