# online.x-402/mcp 64 x402 tools: cheap LLM $0.002, web+news search, French residential-IP scraping, FR/UK/US data. - **Type:** MCP server - **Trust:** 60/100 (B), scored on the content rubric - **Verification:** community-indexed — nobody has claimed this listing - **Version:** 1.0.7 - **Author:** online.x-402 - **License:** Unknown - **Endpoints:** streamable-http https://api.x-402.online/mcp - **Source:** https://api.x-402.online - **Endpoint health:** reachable (last checked 2026-09-16T05:17:17.519Z, 4 samples) — uptime is not a security property and is not part of the trust score - **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport) ## Trust 60/100 (B), scored on the content rubric - Publisher verified: no - Install scripts: nothing suspicious found - Prompt-injection scan: clean - Obfuscation scan: clean - Evidence age: 0 days ## Security scan - **Status:** clean - **Scanned:** 2026-09-16T05:17:17.519Z - **Version scanned:** live - **CVEs:** no coverage — this entry has no package coordinates to query OSV against, so "no known CVEs" is NOT asserted for it. **Findings** - injection-shaped content (note) in the `proxy_1gb` tool: Links to undeclared domain: buyer ## Tools 60 declared. Observed from a live `tools/list` probe. - `transcribe` — Transcribe the actual audio of a YouTube, TikTok or Instagram video with Whisper large-v3. Not caption scraping: the audio is downloaded and run through speech - `proxy_1gb` — Buy 1 GB of residential proxy bandwidth for scraping and agent traffic, delivered as a ready-to-use key in the form http://buyer:KEY@host, valid 30 days and met - `proxy_5gb` — Buy 5 GB of residential proxy bandwidth at 2.40 USD per gigabyte and receive a proxy key valid for 30 days. Traffic exits through a real residential IP address, - `proxy_20gb` — Buy 20 GB of residential proxy bandwidth at 2 USD per gigabyte, the best rate in the range, delivered as a proxy key valid for 30 days. Traffic exits through a - `proxy_port_30d` — Rent a dedicated mobile port for 30 days on a real 4G/5G carrier IP (Orange, France and Guadeloupe, AS16028), up to 100 GB included. You rent the line itself, n - `proxy_port_7d` — Rent a dedicated mobile port for 7 days on a real 4G/5G carrier IP (Orange, France and Guadeloupe, AS16028), up to 25 GB included. You rent the line, not a slic - `proxy_port_1d` — Rent a dedicated mobile port for 24 hours on a real 4G/5G carrier IP (Orange, France and Guadeloupe, AS16028), up to 5 GB included. The entry ticket: qualify th - `mobile-proxy_1gb` — Buy 1 GB of mobile proxy bandwidth on a real 4G/5G carrier IP address (Orange, France and Guadeloupe, AS16028) and receive a proxy key valid for 30 days. Mobile - `mobile-proxy_5gb` — Buy 5 GB of mobile proxy bandwidth on a real 4G/5G carrier IP address (Orange, France and Guadeloupe, AS16028), delivered as a proxy key valid for 30 days. Mobi - `proxy_mobile_1gb` — Buy 1 GB of rotating mobile proxy bandwidth for scraping and agent traffic, on a real 4G/5G carrier IP (Orange, France and Guadeloupe, AS16028). The carrier rea - `proxy_mobile_5gb` — Buy 5 GB of mobile proxy bandwidth on a real 4G/5G carrier IP address (Orange, France and Guadeloupe, AS16028), delivered as a proxy key valid 30 days and meter - `extract` — Send a URL and receive the main content of the page as clean markdown, stripped of navigation, advertising and boilerplate. The page is fetched through a French - `render` — Send a URL and receive the complete HTML of the page after JavaScript execution, exactly as a browser would see it. The request goes through a French residentia - `screenshot` — Send a URL and receive a PNG screenshot of the fully rendered page, captured by a real Chromium browser exiting through a French residential IP. JavaScript is e - `pdf` — Send a URL and receive the page as a PDF document, rendered by a real Chromium browser exiting through a French residential IP. JavaScript runs before printing, - `links` — Send a URL and receive every hyperlink found on the page, resolved to absolute addresses and returned with its anchor text. The page is rendered by a real brows - `meta` — Send a URL and receive its metadata: title, description, Open Graph and Twitter card fields, canonical address, language and favicon. The page is rendered by a - `fr_entreprise-360_partial` — Lite overview of a French company by SIREN or name: legal identity, activity code, headcount bracket and current administrative status, drawn from the official - `fr_entreprise-360` — Complete profile of a French company in a single call, assembled from official sources: legal identity and form, headquarters address, activity code, headcount, - `guard` — Check whether a domain, IP address or email is dangerous before your agent interacts with it. Combines reputation signals, domain age, hosting and known-abuse i - `fr_due-diligence` — Full due-diligence dossier on a French company, assembled from official registries in one call: legal identity, directors and beneficial owners, filed annual ac - `fr_estimation-immo` — Estimate the market value of a French property from its address and surface area, using actual recorded sale prices from the DVF open dataset rather than asking - `fr_bilans` — Annual accounts and financial statements of a French company by SIREN, sourced from the INPI national register, an authentication-gated source most public APIs - `fr_procedures-collectives` — Is this French company in insolvency proceedings? Returns a synthetic status, the full history of court judgments (safeguard, receivership, liquidation) and a r - `fr_score-entreprise_partial` — Lite solidity score for a French company: a rating from 0 to 100, its qualitative level and the count of insolvency proceedings on record. Enough for an agent t - `fr_score-entreprise` — Solidity and risk score from 0 to 100 for a French company, computed by crossing INPI financial accounts (revenue and profit trend), BODACC insolvency proceedin - `fr_analyse-immo_partial` — Lite property analysis for a French address: median price per square metre in the area, estimated value and an investment score. Enough to screen a shortlist of - `fr_analyse-immo` — Full investment analysis of a French property from its address: estimated value against recorded sale prices, median price per square metre, energy performance - `fr_kyb_partial` — Lite know-your-business check on a French company: legal existence, current administrative status and any insolvency flag. The minimum an agent needs to decide - `fr_kyb` — Know-your-business dossier on a French company, assembled from official registries for compliance and onboarding: verified legal identity, company form and regi - `fr_etude-implantation` — Location study for opening a business at a French address: local demographics, purchasing power, existing competition in the same activity, footfall drivers and - `fr_reseau-dirigeant` — Map the network of a French company director: every other company where the same person holds or held a mandate, with each entity's status and activity. Reveals - `fr_concurrents` — Identify the competitors of a French company: businesses sharing the same activity code within the relevant geographic area, returned with their size, age and c - `fr_verif-artisan` — Verify a French craftsman or building trade professional before hiring: legal existence, trade registration, activity code, company age and any insolvency proce - `fr_valorisation` — Estimate the value of a French company from its filed financial accounts, applying sector multiples to revenue and earnings and returning the resulting range wi - `uk_company` — Full profile of a UK company from Companies House: registered name and number, company type, incorporation date, registered office address, SIC activity codes, - `uk_officers` — Directors and officers of a UK company from Companies House: names, roles, appointment and resignation dates, nationality, country of residence and occupation. - `uk_psc` — Persons with significant control of a UK company from Companies House: the beneficial owners, the nature of their control, their ownership bands and the date ea - `uk_company-check` — Consolidated risk check on a UK company in one call: registry identity and status, directors, persons with significant control, filing history and overdue filin - `us_company` — Profile of a US public company from SEC EDGAR: legal name, central index key, ticker symbols, exchange listings, standard industrial classification, business ad - …and 20 more ## Install **Verdict: review** — Installable, but 2 things to check first: No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. **Cautions** (coverage gaps and advisories — never blocking) - No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. - No publisher has proved control of this listing; it is indexed, not vouched for. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"mcp\": {\n \"type\": \"http\",\n \"url\": \"https://api.x-402.online/mcp\"\n }\n }\n}" ``` ## Blast radius Contained to moderate — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: runs on someone else's infrastructure; read-only tool surface. - Floor 9, ceiling 27 (tier: unknown) - `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low. - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/online.x-402%2Fmcp - Install plan: https://forgeregistry.com/api/v1/packages/online.x-402%2Fmcp/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/online.x-402%2Fmcp - HTML page: https://forgeregistry.com/registry/online.x-402%2Fmcp - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.