Tool search 164,478 tools · 10,067 live servers

Run a public web search and return titles, URLs, and snippets as JSON. Use when you need current public web results for a query. Do not use for private/intranet pages — call vc_page_markdown with a known URL instead. Sibling: vc_page_markdown (one URL), pay (generic slug caller). Auth: free-trial or prepaid X-Vibes-Key preferred; else USDC via x402 (~$0.02). Side effects: outbound HTTP to a search provider; no local writes. Returns JSON results, or a payment_required challenge if unpaid.

Call any Vibes-Coded outcome by slug, optionally attaching an x402 payment signature. Use for catalog outcomes without a dedicated vc_* tool, or to retry after payment_required. Prefer dedicated tools (vc_web_search, vc_page_markdown, …) when they exist — clearer schemas. Do not use instead of health(). Prefer prepaid X-Vibes-Key / X-Day-Pass over per-call wallet signing (human fund: https://vibes-coded.com/start). Args: slug: Outcome id, e.g. "web-search" or "agent-state-guard". payment_signature: Optional x402 PAYMENT-SIGNATURE header value. body: JSON object of endpoint fields (query, url, text, …). Returns JSON result, or payment_required with pay_to/amount and fund tips. Side effects: may settle USDC via x402 when paying; otherwise HTTP only.

Read-only query against the currently configured public DNSBL/RBL providers (roughly 60, with noisy providers explicitly disabled). Provide either `domain` to resolve and inspect its MX IPv4 addresses or an IPv4 `ip` for a direct check; at least one is required. Returns each provider's listed/clean result, severity, removal metadata, plus unavailable and disabled provider evidence so timeouts are not misreported as clean. Use for mail-server reputation triage; it is not a delisting service. No auth or destructive actions.

Read-only WHOIS/RDAP lookup for a domain or IP address. For domains it returns registrar, EPP domain-status codes, nameservers, registration/expiry/last-changed dates, and the abuse contact; for IPs it returns the network allocation (CIDR, name, type). Data is sourced live from the IANA RDAP bootstrap with an rdap.org fallback. Registrant personal data is usually GDPR-redacted — that is normal, not an error. Use to check domain ownership, age, or expiry, vet a suspicious domain, or find an abuse contact; for DNS records use lookup_dns instead. `query` is a domain name or an IPv4/IPv6 address. No auth, no side effects.

Look up any IP address, CIDR network, set of networks, or domain in the honeypot dataset. Use this FIRST whenever the user asks: 'is this IP malicious?', 'is this a known scanner?', 'have you seen this IP?', 'what does this IP do?', 'when was it last seen?', 'is this IP in your data?'. Returns: total_events (0 = never observed), first_seen, last_seen, country, ASN, the 50 most-hit ports plus ports_targeted_count for the true total, top user agents, top URL paths, TLS/HTTP/SSH fingerprints. Covers both IPv4 and domains. Also returns our own judgement: `verdict` (human sentence) with `verdict_key` (stable machine value to alert on) and `verdict_why`; `scanner` (benign-scanner identity from our classification table, or null) so research traffic can be told apart from real attacks; and `cve_probes`, the CVE signatures this address was seen probing. WINDOW: `days` bounds the query to the last N days. For a single address leave it unset for every retained event, which is the right default for "have we ever seen this". A CIDR or a domain defaults to the last 90 days, because neither can use an index and unbounded they read the whole table; pass `days` explicitly to widen either back out. The website's /lookup defaults to 7 days for anonymous visitors, so the same address can read very differently on the two surfaces. Every response states which window it used in `window`; quote it alongside any count you report. RANGES: pass a CIDR ('103.66.28.0/22') for a whole-network aggregate, or several at once separated by commas, spaces or newlines ('103.66.28.0/22, 8.34.210.32/27') to answer 'have any of this vendor's ranges touched us' in ONE call. Never expand a network into individual addresses and loop -- that is hundreds of calls for an answer this returns in one, and it will exhaust your quota. A range answer sets query_type to 'cidr' or 'cidr_set', lists every range back in `ranges`, and gives `per_range` counts plus `top_source_ips`; total_events 0 with those fields present is a real observed absence.

Collect bounded context from configured upstream MCP servers for a remediation query.

List concise remediation playbook records, optionally filtered by query or category.

Search CVEs in the vulnerability database by keyword, CVSS severity/score, EPSS exploit-prediction likelihood, attack vector, recency, or CISA KEV status. Returns CVSS, EPSS, KEV flag, and affected products, newest first. Threat intel from NVD, EPSS, CISA KEV, and GHSA. PAID: $0.01 per query after a daily free allowance (25/day). On a 402, settle the returned payment request and re-call with the SAME args plus payment_tx=<reference>. agent_id scopes your allowance; an Authorization: Bearer fnet_ key bypasses it.

Check IP reputation — abuse reports, threat type, confidence, ISP, and OTX pulse associations for an IP. Threat intel combining AbuseIPDB and AlienVault OTX. PAID: $0.01 per query after the daily free allowance (25/day). On a 402, settle the returned payment request and re-call with the SAME args plus payment_tx=<reference>. An Authorization: Bearer fnet_ key bypasses it.

Check domain reputation — threat indicators, OTX pulse associations, and threat classification for a domain. Threat intel from AlienVault OTX. PAID: $0.01 per query after the daily free allowance (25/day). On a 402, settle the returned payment request and re-call with the SAME args plus payment_tx=<reference>. An Authorization: Bearer fnet_ key bypasses it.

Scan a product/vendor/CPE for all known vulnerabilities, sorted by EPSS exploit-prediction likelihood with CISA KEV flags — the "should I be worried about this dependency?" security scanning tool. Threat intel from NVD, EPSS, CISA KEV, and GHSA. Premium. PAID: $0.02 per query after the daily free allowance (25/day). On a 402, settle the returned payment request and re-call with the SAME args plus payment_tx=<reference>. An Authorization: Bearer fnet_ key bypasses it.

Pull the recent threat-intelligence feed — real-time threat indicators (IPs, domains, hashes, URLs) from AlienVault OTX pulses and reputation checks, filterable by type, threat, confidence, and recency. PAID: $0.01 per query after the daily free allowance (25/day). On a 402, settle the returned payment request and re-call with the SAME args plus payment_tx=<reference>. An Authorization: Bearer fnet_ key bypasses it.

Resolve a named MCP server, vendor, product, package, repository, Registry identifier, or endpoint to a canonical MCPLookup identity. Returns at most five reviewed candidates with query-relative identity and publisher explanations, a compact trust assessment, and current connection options. This is the best fit when a particular artifact or product is known; find_servers covers open-ended capability discovery, while trust_lookup returns the full current evidence record for an exact canonical name.