Tlacuilo

Install

Pick the AI app you use, then copy the settings.

Passed 5/5 checks · What you ask goes through the maker’s server (tlacuilo-jet.vercel.app) · ✓ Commands checked Nov 15, 2026

claude mcp add --transport http --scope user tlacuilo https://tlacuilo-jet.vercel.app/mcp

{
  "mcpServers": {
    "tlacuilo": {
      "url": "https://tlacuilo-jet.vercel.app/mcp"
    }
  }
}

{
  "servers": {
    "tlacuilo": {
      "type": "http",
      "url": "https://tlacuilo-jet.vercel.app/mcp"
    }
  }
}

Which apps can use it

Based on how this server connects and on each app’s own docs, checked Nov 10, 2026.

Connect over the internet in

ClaudeChatGPTGooseLM StudioMsty StudioCherry StudioCursorVS Code + GitHub CopilotVisual StudioWindsurf (Devin Desktop)ZedKiroClineContinueJetBrains AI AssistantClaude CodeCodex CLIGemini CLIOpenCodenodecodeWarpLibreChatOpen WebUIRaycast

All apps, with pros and cons →

What it can do

Tool names and descriptions exactly as the server reported them on Nov 15, 2026. The maker wrote them, not us; we show them as plain text.

• catalog

  Free. Lists every tool with its price in USD, the accepted networks and how x402 payment works over MCP.

• health

  Free. Payment network, facilitator and configured data sources.

• web_read

  Read any public web page as clean, LLM-ready markdown: title, meta description, language and main content with navigation, ads and scripts removed. Follows redirects. Cheapest way to read a URL before deciding whether to pay for a full render. Price: $0.001 USDC per call (x402).

• x402_find

  Which x402 API should I call for this task? Searches the Coinbase Bazaar catalog and ranks candidates by evidence of real use: distinct payers, repeat calls per payer, recency of payments and price. Returns up to 10 endpoints with URL, price, networks, example input and the reaso

• token_verdict

  Token verdict for a Base contract or Solana mint: DEX market data (price, liquidity, 24h volume, buys/sells, pair age), security checks (honeypot, taxes, mint/owner powers, holder concentration via GoPlus; RugCheck risks and LP lock on Solana), red and green flags, a one-word ver

• msg_box

  Creates a private mailbox for agent-to-agent messaging and returns its 22-character id plus a secret read key. Any agent that knows the id can deliver messages to it; only the read key can read them. The mailbox lives 30 days; messages are kept 7 days, newest first, up to 500. Op

• msg_send

  Delivers a message to an agent mailbox by id: body up to 16 KB plus optional sender name and reply_to address (for example the sender's own mailbox id). Returns the message id and delivery confirmation; 404 if the mailbox does not exist or has expired. A public demo mailbox (demo

• msg_inbox

  Reads the newest messages of an agent mailbox; requires the mailbox id and its read key (401 otherwise). Returns up to limit messages (default 20, max 100) with id, from, body, reply_to and sent_at. Reads are non-destructive unless ack=true, which removes the returned messages so

• guard_injection

  Prompt-injection detector for text an agent is about to feed to a model: tool results, scraped pages or user input. Rules and heuristics only, no LLM, fast and deterministic. Returns risk 0-1, a clean/suspicious/malicious verdict, the categories found (instruction override, role

• agents_readiness

  Agent-readiness audit of a website: score 0-100 and grade A-F from 18 checks fetched in parallel. Covers robots.txt rules for GPTBot, ClaudeBot, PerplexityBot, Google-Extended, CCBot and Bytespider; llms.txt; sitemap.xml; openapi.json, ai-plugin.json, MCP and x402 discovery files

• dns

  Full DNS profile of a domain in one call: A, AAAA, CNAME, MX, NS, TXT, SOA and CAA records, SPF and DMARC parsed (policy, all-mechanism, reporting address), DNSSEC validation flag, and inferred providers for DNS hosting, email and web hosting. Resolved over DNS-over-HTTPS with a

• domain

  Domain registration record from the authoritative registry via RDAP (the successor to WHOIS): whether the domain is registered, registrar name and IANA ID, abuse contact, creation, last-change and expiration dates, days until expiry, EPP status codes, registry nameservers and DNS

• web_tables

  Every HTML table on a public web page as structured JSON: title (caption or nearest heading), headers, rows as arrays and as records keyed by header, numeric columns detected and parsed to numbers, colspan and rowspan expanded, footnote markers removed. Selecting one table by ind

• email_validate

  Email address check without sending mail: RFC-style syntax validation, domain deliverability from MX (or A/AAAA fallback) over DNS-over-HTTPS, mail exchangers, disposable-domain and free-provider detection, role-based local parts (info, support, noreply), typo suggestion for comm

• polymarket_markets

  Polymarket prediction markets matching a text query, or the top markets by 24-hour volume when no query is given. Each market includes the question, every outcome with its current price (implied probability), the Yes probability, total and 24h volume, liquidity, end date, status

• polymarket_market

  One Polymarket market by numeric id or slug: question, resolution description, outcomes with current prices, Yes probability, last trade, best bid and ask, 24h price change, total and 24h volume, liquidity, end date, status, parent event, tags and the Polymarket URL. Source: Poly

• sec_filings

  SEC EDGAR filings for a US-listed company by ticker or CIK, newest first, optionally filtered by form type (10-K, 10-Q, 8-K, 4, S-1...). Returns company name, CIK, SIC code and industry, state and fiscal year end, and for each filing the form, filing date, period, accession numbe

• sec_facts

  Reported financial values of a US-listed company from SEC XBRL company facts: the most recent annual (10-K) and quarterly (10-Q) figures for one concept such as revenue, net income, diluted EPS, total assets, cash or shares outstanding, with fiscal year, period dates, unit, form

• federal_register_search

  US Federal Register documents (final rules, proposed rules, notices, presidential documents) matching a full-text query, newest first, with optional filters by agency, document type and publication date. Each document includes number, title, type, abstract, agencies, publication

• papers_search

  Full-text search across 250M+ scholarly works in OpenAlex: title, authors, year, venue, type, citation count, open-access status with PDF link, reconstructed abstract (up to 1500 chars) and topics. Filters by publication date range and open access; sorted by relevance or citation

• papers_cite

  Formatted citation for any DOI registered with Crossref or DataCite (journal articles, books, arXiv preprints, datasets): BibTeX entry plus a formatted reference in APA, MLA, Chicago author-date, IEEE, Harvard, Nature or AMA style. Resolves through DOI content negotiation with Cr

• clinical_trials_search

  Clinical trial search on ClinicalTrials.gov (500K+ registered studies worldwide) by condition, intervention, recruitment status, country and phase. Each study includes NCT ID, title, status, phase, conditions, interventions with type, lead sponsor, enrollment, start and completio

• deps_check

  Security and freshness check for one package version across npm, PyPI, Go, Maven, Cargo and NuGet: known vulnerabilities from OSV with CVE aliases, CVSS score and level, fixed versions and advisory URL; latest version, versions behind, publish date, licenses, deprecation flag and

• deps_audit

  Vulnerability audit of up to 200 pinned dependencies in one call against the OSV database (npm, PyPI, Go, Maven, Cargo, NuGet). Accepts a package list or a package.json (dependencies and devDependencies, range prefixes stripped). Returns, per package, every known advisory with CV

• rfc_validar

  Validates a Mexican RFC (tax ID): structure, person type (física/moral), embedded date and SAT check digit. Offline, no SAT call. Price: $0.002 USDC per call (x402).

• curp_validar

  Validates a Mexican CURP: 18-character structure, check digit, and decodes sex, birth date and state of birth. Offline. Price: $0.002 USDC per call (x402).

• cp

  Mexican postal code lookup from the national catalog of Correos de México: state, municipality, city and every neighborhood (colonia) with its settlement type. Price: $0.003 USDC per call (x402).

• dias_habiles

  Mexican banking business days per the CNBV calendar: whether a date is a business day, the next and previous business day, and a date plus N business days. Price: $0.002 USDC per call (x402).

• uma

  Current and historical UMA (Unidad de Medida y Actualización) values published by INEGI: daily, monthly and annual amounts with their effective dates. Price: $0.001 USDC per call (x402).

• salario_minimo

  Mexican minimum wage set by CONASAMI: general daily rate and the Northern Border Free Zone rate for a given year, with monthly equivalents. Price: $0.001 USDC per call (x402).

• iva

  Mexican VAT (IVA) and retention rates: general 16%, northern/southern border 8%, 0% and exempt categories, plus ISR and IVA retention rates for professional services and leases. Price: $0.001 USDC per call (x402).

• banxico

  Latest value of an official Banco de México series: fix (USD/MXN FIX rate), udis, tiie28, tasa-objetivo, or any raw SIE series ID. Returns the date and value as published. Price: $0.003 USDC per call (x402).

• sat_69b

  Checks an RFC against the SAT 69-B list of taxpayers with presumed non-existent operations (EFOS). Returns status (presunto, desvirtuado, definitivo, sentencia favorable), notice numbers and publication dates. Price: $0.02 USDC per call (x402).

• sat_cfdi_verificar

  Verifies a CFDI 3.3/4.0 invoice against the SAT web service: whether it exists, is vigente or cancelado, its cancellation status and EFOS flag. Needs UUID, issuer RFC, receiver RFC, total and the last 8 characters of the seal. Price: $0.03 USDC per call (x402).

• empresas_buscar

  Searches Mexican businesses in INEGI's DENUE directory (5M+ establishments) by name or keyword, optionally filtered by state. Returns name, legal name, activity, address, postal code, phone, email, website, size and coordinates. Price: $0.05 USDC per call (x402).

• empresas_cerca

  Finds Mexican businesses near a coordinate using INEGI's DENUE: keyword plus latitude, longitude and radius up to 5,000 m. Same fields as the name search. Price: $0.05 USDC per call (x402).

• empresas

  Full record of one Mexican business from INEGI's DENUE by establishment ID: identification, activity, address, contact, size, type and coordinates. Price: $0.02 USDC per call (x402).

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 15, 2026

• ✓ Pass

  Maker matches the repo

  The registry name was verified with the GitHub account mastercobeos, which owns the repo

• ✓ Pass

  Still maintained

  Code last changed today

• ✓ Pass

  Has a licence

  Uses MIT

• ✓ Pass

  Endpoint responds

  Responded in 165 ms (HTTP 200)

• – Not applicable

  Sign-in with OAuth

  No sign-in needed

• ✓ Pass

  No hidden instructions in tool descriptions

  Read 37 tool descriptions and found no hidden instructions to the AI

What we check → · JSON

User reviews

No reviews yet

Sign in to write a review

Compared with others in Cybersecurityi

• More stars than 0% of the other 1063 servers in this category
• Published to the registry more recently than 99% of the other 1063 servers in this category
• Basic checks equal to or better than 100% of the other 1063 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Similar alternatives

Same category, other makers, commands already checked. Official ones first, then by stars.

Reading a card:↓ Downloads per weeki★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

GitHits

Search public open-source code, documentation, metadata, vulnerabilities, changelogs, and examples.

by githits-com·Growing·↓ 3.8K/wk·★ 136·Updated 6 days ago

Computer or cloud✓ service owner · githits.com

Install

Dependency Management MCP Server

Sonatype component intelligence: versions, security analysis, and Trust Score recommendations

by sonatype·Early·★ 72·Updated 12 months ago

Runs in the cloud✓ sonatype.com

How to connect

Snyk MCP

Easily find and fix security issues in your applications leveraging Snyk platform capabilities.

by snyk·Widely used·↓ 762.1K/wk·★ 62·Updated 6 months ago

Runs on your computer✓ service owner · snyk.io

Install

Draugr

Security scanning for AI agents: SAST, SCA, secrets, IaC, DAST, ranked by real risk.

by draugr-dev·Early·★ 29·Updated today

Runs on your computer✓ service owner · draugr.dev

Install

Spotdb

Ephemeral data sandbox for AI workflows with guardrails and security

by aliengiraffe·Early·★ 21·Updated 13 months ago

Runs on your computer✓ aliengiraffe.ai

Install

• GitHits — Cloud or install on your computer · No key needed
• Dependency Management MCP Server — Runs in the cloud, nothing to install · No key needed
• Snyk MCP — Installs on your computer · No key needed
• Draugr — Installs on your computer · No key needed
• Spotdb — Installs on your computer · No key needed

README from the maker

curl -i "https://tlacuilo-jet.vercel.app/api/v1/banxico/fix"

HTTP/1.1 402 Payment Required

curl -s -i "https://tlacuilo-jet.vercel.app/api/v1/banxico/fix" \

{

import { x402Client, wrapFetchWithPayment, decodePaymentResponseHeader } from "@x402/fetch";

npm i @x402/fetch @x402/svm @solana/kit @scure/base

import { ExactEvmScheme } from "@x402/evm/exact/client";

claude mcp add --transport http tlacuilo https://tlacuilo-jet.vercel.app/mcp

{

import { createx402MCPClient } from "@x402/mcp";

npm i @x402/mcp @x402/svm @solana/kit @modelcontextprotocol/sdk