MCP Services

Multi-tool MCP server + REST API for AI agents. 29 tools across web scraping, SEO analysis, agent memory, screenshot/PDF generation, domain intelligence, content extraction, multi-chain EVM blockchain queries, and security toolkit.

Live: mcp.skills.ws | Docs: llms.txt | npm: npm install -g mcp-services

Quick Start

Use the hosted version (no setup)

Add to your MCP client config (Claude Desktop, Cursor, OpenClaw, etc.):

{
  "mcpServers": {
    "mcp-services": {
      "url": "https://mcp.skills.ws/mcp/sse"
    }
  }
}

Free tier: 10 calls/day, no auth needed.

Self-host

npm install -g mcp-services
mcp-services
# -> running on http://localhost:3100

Tools (29)

Web Scraping

Tool	Endpoint	Description
`scrape`	`GET /api/scrape`	URL to clean Markdown with headings, lists, links, code blocks, tables
`crawl`	`GET /api/crawl`	Crawl a site from starting URL, follow internal links (depth 1-3, max 20 pages)
`extract`	`GET /api/extract`	Extract structured data: JSON-LD, Open Graph, meta tags, headings, links, images, tables

SEO Toolkit

Tool	Endpoint	Description
`serp`	`GET /api/serp`	Google SERP scraping -- top 20 results, People Also Ask, featured snippets, related searches
`onpage_seo`	`GET /api/onpage-seo`	Full on-page SEO audit with score (0-100) -- title, meta, headings, images, schema, Open Graph
`keywords_suggest`	`GET /api/keywords`	Google Autocomplete keyword suggestions with A-Z expansion (100+ ideas)

Agent Memory

Tool	Endpoint	Description
`memory_store`	`POST /api/memory`	Store a memory (key-value, namespace-scoped, with tags). Upserts on key conflict
`memory_get`	`GET /api/memory`	Retrieve a memory by namespace + key
`memory_search`	`GET /api/memory/search`	Full-text search across memories in a namespace
`memory_list`	`GET /api/memory/list`	List all memories in a namespace with pagination
`memory_delete`	`DELETE /api/memory`	Delete a memory by namespace + key

Screenshot & PDF

Tool	Endpoint	Description
`screenshot`	`GET /api/screenshot`	PNG/JPEG screenshot of any URL
`pdf`	`GET /api/pdf`	Generate PDF of any URL
`pdf2docx`	`GET /api/pdf2docx`	Convert PDF (from URL) to Word/DOCX -- text extraction with heading detection

Content Extraction

Tool	Endpoint	Description
`html2md`	`GET /api/html2md`	Fetch URL, strip nav/ads/scripts, convert to Markdown
`ocr`	`GET /api/ocr`	Extract text from image URL via Tesseract.js OCR

Domain Intelligence

Tool	Endpoint	Description
`whois`	`GET /api/whois`	WHOIS registrar, creation date, expiry, name servers
`dns`	`GET /api/dns`	DNS records -- `A`, `AAAA`, `MX`, `NS`, `TXT`, `CNAME`, `SOA`, or `ALL`
`ssl`	`GET /api/ssl`	SSL certificate issuer, validity dates, expiry countdown, fingerprint

Blockchain (6 EVM chains)

Tool	Endpoint	Description
`balance`	`GET /api/chain/balance`	Native token balance for any address
`erc20_balance`	`GET /api/chain/erc20`	ERC20 token balance, symbol, decimals
`transaction`	`GET /api/chain/tx`	Transaction details -- from, to, value, gas, status

Supported chains: Ethereum, Base, Arbitrum, Optimism, Polygon, Celo

Security Toolkit

Tool	Endpoint	Description
`url_scan`	`GET /api/security/url-scan`	Phishing & malware detection -- VirusTotal + heuristics (typosquatting, homoglyphs, suspicious TLDs, free hosting)
`wallet_check`	`GET /api/security/wallet-check`	Ethereum wallet risk assessment -- Etherscan verification, tx patterns, OFAC sanctions, address poisoning warnings
`contract_scan`	`GET /api/security/contract-scan`	Smart contract honeypot & risk detection -- Honeypot.is + source code analysis (mint, blacklist, fee manipulation, proxy)
`email_headers`	`GET /api/security/email-headers`	Email authentication check -- SPF, DKIM, DMARC, MX records via DNS
`threat_intel`	`GET /api/security/threat-intel`	IOC lookup -- AbuseIPDB + VirusTotal + OTX AlienVault with weighted confidence scoring for IPs, domains, URLs, hashes
`header_audit`	`GET /api/security/header-audit`	Security header score (0-100) -- HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, cookie flags
`vuln_headers`	`GET /api/security/vuln-headers`	Information leakage detection -- Server version, X-Powered-By, debug headers, CORS misconfiguration

Security tools degrade gracefully without API keys (heuristics-only mode). Optional keys: VT_API_KEY, ABUSEIPDB_API_KEY, ETHERSCAN_API_KEY.

Authentication

Three tiers -- use whichever fits:

Tier	How	Limit	Cost
Free	No auth needed	10 calls/day per IP	$0
API Key	`X-Api-Key` header	Unlimited	$9/mo
x402	`X-Payment` header	Pay per call	$0.005/call

API Key

Subscribe via Stripe to get an unlimited API key:

For migration only, query-string API keys (?apikey=) can be temporarily re-enabled with ALLOW_APIKEY_QUERY=true. This mode is deprecated; prefer X-Api-Key.

# 1. Create checkout session
curl -X POST https://mcp.skills.ws/billing/checkout
# Returns: { "url": "https://checkout.stripe.com/..." }

# 2. Complete payment at the Stripe URL
# 3. You'll receive your API key on the success page (shown once only -- save it)

# 4. Use it
curl -H "X-Api-Key: mcp_your_key" "https://mcp.skills.ws/api/whois?domain=example.com"

x402 Pay-per-call

No account needed. Pay with USDC or USDT on Base or Celo. x402-compatible agents handle payment automatically.

curl -H "X-Payment: <base64-encoded-json>" "https://mcp.skills.ws/api/screenshot?url=https://example.com"

REST API

All tools are also available as REST endpoints:

# Web Scraping
curl "https://mcp.skills.ws/api/scrape?url=https://example.com"
curl "https://mcp.skills.ws/api/crawl?url=https://example.com&depth=2&maxPages=10"
curl "https://mcp.skills.ws/api/extract?url=https://example.com"

# SEO
curl "https://mcp.skills.ws/api/serp?keyword=mcp+server"
curl "https://mcp.skills.ws/api/onpage-seo?url=https://example.com"
curl "https://mcp.skills.ws/api/keywords?keyword=ai+agents"

# Memory
curl -X POST "https://mcp.skills.ws/api/memory" \
  -H "Content-Type: application/json" \
  -d '{"namespace":"my-agent","key":"greeting","value":"Hello world","tags":["demo"]}'
curl "https://mcp.skills.ws/api/memory?namespace=my-agent&key=greeting"
curl "https://mcp.skills.ws/api/memory/search?namespace=my-agent&query=hello"

# Domain Intelligence
curl "https://mcp.skills.ws/api/whois?domain=example.com"
curl "https://mcp.skills.ws/api/dns?domain=example.com&type=ALL"
curl "https://mcp.skills.ws/api/ssl?domain=example.com"

# Content
curl "https://mcp.skills.ws/api/screenshot?url=https://example.com&format=png"
curl "https://mcp.skills.ws/api/pdf?url=https://example.com"
curl "https://mcp.skills.ws/api/pdf2docx?url=https://example.com/document.pdf"

# Blockchain
curl "https://mcp.skills.ws/api/chain/balance?address=0x...&chain=ethereum"
curl "https://mcp.skills.ws/api/chain/erc20?address=0x...&token=0x...&chain=celo"

# Security
curl "https://mcp.skills.ws/api/security/url-scan?url=https://suspicious-site.com"
curl "https://mcp.skills.ws/api/security/wallet-check?address=0x...&chain=ethereum"
curl "https://mcp.skills.ws/api/security/contract-scan?address=0x...&chainId=1"
curl "https://mcp.skills.ws/api/security/email-headers?domain=example.com"
curl "https://mcp.skills.ws/api/security/threat-intel?ioc=8.8.8.8&type=ip"
curl "https://mcp.skills.ws/api/security/header-audit?url=https://example.com"
curl "https://mcp.skills.ws/api/security/vuln-headers?url=https://example.com"

Environment Variables

Variable	Default	Description
`PORT`	`3100`	Server port
`CHROMIUM_PATH`	`/usr/bin/chromium-browser`	Path to Chromium
`MAX_BROWSERS`	`3`	Max concurrent browser instances
`MAX_SSE_SESSIONS`	`50`	Max MCP SSE sessions
`MAX_SSE_PER_IP`	`5`	Max concurrent SSE sessions per client IP
`SSE_CONNECT_MAX_PER_WINDOW`	`30`	Max SSE connection attempts per IP per window
`SSE_CONNECT_WINDOW_MS`	`60000`	SSE connect rate-limit window in ms
`SSE_ALLOWED_HOSTS`	--	Comma-separated allowlist for `Host` header on `/mcp/sse` + `/mcp/messages` (e.g. `mcp.example.com,localhost`)
`SSE_ALLOWED_ORIGINS`	--	Optional comma-separated allowlist for `Origin` header (full origins like `https://app.example.com`)
`FREE_DAILY_LIMIT`	`10`	Free tier request limit
`FREE_WINDOW_MS`	`86400000`	Free-tier rate-limit window in ms
`REDIS_URL`	--	Optional Redis backend for shared/distributed rate-limits
`API_KEYS`	--	Comma-separated valid API keys
`ALLOW_APIKEY_QUERY`	`true` in non-production, `false` in production	Allow deprecated `?apikey=` auth during migration
`ADMIN_SECRET`	--	Secret for admin endpoints
`STRIPE_SK`	--	Stripe API key for Pro subscriptions
`STRIPE_WEBHOOK_SECRET`	--	Stripe webhook signing secret
`STRIPE_WEBHOOK_IP_ALLOWLIST`	--	Optional CSV allowlist for webhook source IPs
`CHECKOUT_LIMIT_PER_HOUR`	`5`	Per-IP Stripe checkout creation limit
`X402_PRICE_USD`	`0.005`	x402 price per call
`X402_RECEIVER`	--	x402 payment receiver address
`X402_MAX_TX_AGE_SECONDS`	`86400`	Maximum accepted payment tx age in seconds (stale txs are rejected)
`X402_TX_CACHE_FILE`	`./data/x402-tx-cache.json`	Persistent replay-protection cache for used x402 tx hashes
`X402_TEST_MODE`	`0`	Set to `1` only for local/offline testing; ignored in production
`MEMORY_DB_PATH`	`./data/memory.db`	SQLite memory database path
`VT_API_KEY`	--	VirusTotal API key (free: 4/min, 500/day)
`ABUSEIPDB_API_KEY`	--	AbuseIPDB API key (free: 1000/day)
`ETHERSCAN_API_KEY`	--	Etherscan API key (free: 5/sec)
`TRUST_PROXY`	`false`	Express trust proxy setting (`false`, `true`, hop count like `1`, or subnet names/CIDRs like `loopback`/`10.0.0.0/8`)

Reverse proxy & client IP configuration

mcp-services defaults to TRUST_PROXY=false, which means the app ignores X-Forwarded-For and uses the direct socket peer IP for rate limits and free-tier memory namespacing.

Enable TRUST_PROXY only when your deployment is actually behind a trusted reverse proxy/load balancer that rewrites forwarding headers. Common options:

TRUST_PROXY=1 when exactly one trusted proxy sits in front of Node.js
TRUST_PROXY=loopback for local proxy setups
TRUST_PROXY=<cidr> (or comma-separated values) for explicit trusted proxy ranges

When trust proxy is enabled, Express derives req.ip from X-Forwarded-For according to that trust policy. Ensure your edge proxy:

Appends/sets a valid X-Forwarded-For chain
Prevents direct untrusted clients from spoofing forwarding headers
Forwards the real client address as the left-most IP in X-Forwarded-For

If X-Forwarded-For is present while TRUST_PROXY=false, the server logs a defensive warning and ignores that header.

For production, set SSE_ALLOWED_HOSTS and SSE_ALLOWED_ORIGINS to strict, explicit values (only your public MCP domain and trusted app origins). Avoid wildcards or broad internal host lists.

Deployment hardening checklist (recommended)

Set NODE_ENV=production
Keep ALLOW_APIKEY_QUERY=false (header auth only)
Configure TRUST_PROXY correctly for your network path (do not blindly set true)
Set strict SSE_ALLOWED_HOSTS and SSE_ALLOWED_ORIGINS
Use REDIS_URL for shared rate-limits in multi-instance deployments
Rotate ADMIN_SECRET and Stripe keys periodically
Keep X402_TEST_MODE=0 in production (enforced by server)
Persist KEYS_FILE, MEMORY_DB_PATH, and X402_TX_CACHE_FILE on durable storage
Run npm audit in CI and fail builds on high/critical vulnerabilities

Production env quickstart

cp .env.production.example .env
# then edit .env values for your domain, proxy topology, redis and secrets

Stripe webhook edge allowlist auto-sync (nginx)

# Generate CIDR allowlist include from Stripe source and reload nginx
scripts/sync-stripe-webhook-ips.sh \
  --out /etc/nginx/snippets/stripe-webhook-allowlist.conf \
  --reload "systemctl reload nginx"

See deploy/nginx/stripe-webhook.conf.example for the webhook location block.

Security

SSRF protection: URL validation + DNS pre-resolution + private IP blocking + Puppeteer request interception
Domain validation: regex allowlist prevents command injection
Input sanitization: format validation per IOC type, address format checks, chain allowlists
Memory namespace isolation per auth tier (API key hash, IP, or x402)
Rate limiting on free tier
Resource limits: max concurrent browsers, SSE sessions, PDF size cap, 5MB response body limit
Response size limits on external API fetches

Architecture

                  +------------------------------------+
                  |          Express Server             |
                  |                                     |
                  |  +---------+    +--------------+    |
  MCP SSE ------->  | MCP SDK |    |  Auth Layer   |   |
                  |  |  (SSE)  |    | free/key/x402 |   |
                  |  +---------+    +--------------+    |
                  |                                     |
  REST API ------>  +--------------------------------+  |
                  |  |        29 Tool Handlers        |  |
                  |  | scrape | crawl | extract       |  |
                  |  | serp | onpage_seo | keywords   |  |
                  |  | memory (5) | screenshot | pdf  |  |
                  |  | html2md | ocr | whois | dns    |  |
                  |  | ssl | balance | erc20 | tx     |  |
                  |  | url_scan | wallet_check        |  |
                  |  | contract_scan | email_headers   |  |
                  |  | threat_intel | header_audit     |  |
                  |  | vuln_headers                    |  |
                  |  +--------------------------------+  |
                  |        |              |              |
                  |  +-----+----+  +-----+----------+   |
                  |  | Puppeteer|  | viem (6 RPCs)   |   |
                  |  | Chromium |  | whois-json      |   |
                  |  |          |  | dns/promises    |   |
                  |  |          |  | security.js     |   |
                  |  +----------+  +-----------------+   |
                  |                                     |
  Stripe -------->  +--------------------------------+  |
  Webhooks        |  |   Billing (stripe.js)          |  |
                  |  |   checkout -> key provisioning  |  |
                  |  +--------------------------------+  |
                  +------------------------------------+

Stack

Runtime: Node.js 22 + Express
Browser: Puppeteer (Chromium) -- screenshots, PDF, OCR, html2md
Blockchain: viem -- 6 EVM chains via public RPCs
Security: VirusTotal, AbuseIPDB, Etherscan, Honeypot.is, OTX AlienVault + heuristics
Payments: Stripe (subscriptions), x402 protocol (stablecoins on Base/Celo)
MCP: @modelcontextprotocol/sdk with SSE transport
Hosting: Aleph Cloud (decentralized compute)

License

MIT -- Commit Media SARL

Name		Name	Last commit message	Last commit date
Latest commit History 71 Commits
.github/workflows		.github/workflows
deploy/nginx		deploy/nginx
public		public
scripts		scripts
.env.example		.env.example
.env.production.example		.env.production.example
.gitignore		.gitignore
.npmignore		.npmignore
LICENSE		LICENSE
PRICING.md		PRICING.md
README.md		README.md
SECURITY.md		SECURITY.md
auth.js		auth.js
ip.js		ip.js
memory.js		memory.js
package-lock.json		package-lock.json
package.json		package.json
rate-store.js		rate-store.js
scrape.js		scrape.js
security.js		security.js
seo.js		seo.js
server.js		server.js
stripe.js		stripe.js

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Repository files navigation

MCP Services

Quick Start

Use the hosted version (no setup)

Self-host

Tools (29)

Web Scraping

SEO Toolkit

Agent Memory

Screenshot & PDF

Content Extraction

Domain Intelligence

Blockchain (6 EVM chains)

Security Toolkit

Authentication

API Key

x402 Pay-per-call

REST API

Environment Variables

Reverse proxy & client IP configuration

Deployment hardening checklist (recommended)

Production env quickstart

Stripe webhook edge allowlist auto-sync (nginx)

Security

Architecture

Stack

License

About

Uh oh!

Releases

Packages

Uh oh!

Contributors

Uh oh!

Languages

Folders and files

Latest commit

History

Repository files navigation

MCP Services

Quick Start

Use the hosted version (no setup)

Self-host

Tools (29)

Web Scraping

SEO Toolkit

Agent Memory

Screenshot & PDF

Content Extraction

Domain Intelligence

Blockchain (6 EVM chains)

Security Toolkit

Authentication

API Key

x402 Pay-per-call

REST API

Environment Variables

Reverse proxy & client IP configuration

Deployment hardening checklist (recommended)

Production env quickstart

Stripe webhook edge allowlist auto-sync (nginx)

Security

Architecture

Stack

License

About

Resources

License

Security policy

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Uh oh!

Contributors

Uh oh!

Languages

Packages