Toolweather suite

PayCheck

Ask whether a merchant, URL, or wallet is safe to pay before an agent sends money.

Deterministic score. No payment execution. No wallet keys. Policy version 1.

Trusted · 100

https://api.openai.com is on the allowlist of known AI and developer APIs.

Unknown or suspicious

A new or random domain is never trusted, even if you reword the purpose.

Block

http://1.2.3.4, localhost, burn addresses, and typosquats are refused.

What it checks

Pass a domain, an https URL, or a 0x wallet. PayCheck returns a score from 0 to 100, a verdict (trusted, unknown, suspicious, or block), reasons, and a recommended action.

Trusted is reserved for the published allowlist over https on port 443. Wallets are never trusted in v1: there is no chain analysis. Domain age comes from public RDAP. If that lookup fails, the age is unknown. PayCheck does not invent one.

amount_usd, category, and any purpose text are discarded. They do not change the score and they are not stored.

Free tier

CallerChecks / UTC dayPrice
Anonymous IP100Free
Free pc_live_… key1,000Free
Bundle hex client1,000Free
Bundle anon: client100Free
Over the capeach extra check$0.001 USDC on Base

Quota, key minting, docs, and MCP discovery are not billed. The same target is free to repeat for 60 seconds. If PAY_TO is unset, over-cap calls return HTTP 402 payment_not_configured.

REST

curl -s -X POST "$ORIGIN/v1/check" \
  -H 'content-type: application/json' \
  -d '{"target":"https://api.openai.com"}'

curl -s -X POST "$ORIGIN/v1/keys"
curl -s "$ORIGIN/v1/quota"
curl -s "$ORIGIN/v1/policy"

MCP

Streamable HTTP on POST /mcp. Protocols 2025-06-18 and 2025-03-26. Tools: check_merchant, get_quota, get_api_key.

{
  "mcpServers": {
    "paycheck": {
      "type": "http",
      "url": "https://YOUR-WORKER.workers.dev/mcp"
    }
  }
}

Call get_api_key once and store the key. Do not call it every turn. Glama can also launch the stdio build: node dist/stdio.js.

What it will not do