Stormap

Measured conclusion: Deep-tested. L2 outcome: tools_ok.

Brainstorm scored idea maps, check npm/PyPI packages and vendors, find the right paid API.

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "Stormap": {
      "url": "https://stormap.ai/mcp",
      "transport": "streamable-http"
    }
  }
}

Measured tools (19)

• vendor_trust_profile read-only

  Vendor security review / third-party risk check: a first-pass security and privacy profile of a software vendor from its own public website, given a domain. Answers "is this vendor SOC 2 certified?" and "do they train AI on our data?": certifications it claims (SOC 2 Type I/II, ISO 27001/27701/42001, HIPAA, PCI DSS, FedRAMP…), whether it trains AI models on customer data (with the exact quote and page), subprocessor list, DPA, data residency, security features (SSO/SAML, SCIM, MFA, encryption, pen tests, bug bounty), security.txt contact, status page, links to trust center, privacy policy and terms, plus a 0-100 transparency score. Use for vendor risk assessments, procurement and security questionnaires. Certifications are vendor claims, not verified audits.

  Parameters:

  • domain (required) — string — Vendor domain, e.g. "notion.com".

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world yes

• company_changes read-only

  Did they raise prices or change their terms? What changed on a company's pricing, terms of service, privacy policy and subprocessor pages, and when. Returns the change history (prices added/removed, free plan or trial added/removed, subprocessors added/removed, text added/removed) and the current prices. Stormap checks tracked pages about once a day; asking about a new company starts tracking it, so history builds from that day. Useful for competitor monitoring, vendor renewals and compliance.

  Parameters:

  • domain (required) — string — Company domain, e.g. "linear.app".
  • since_days — integer — Only return changes from the last N days.

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world yes

• agentic_commerce_readiness read-only

  Is this store ready for ChatGPT shopping? Audit whether an online store is ready for AI shopping agents (ChatGPT shopping and Instant Checkout via ACP, Google AI Mode via UCP, Perplexity, Claude): AI bot access to product pages, Product structured data (price, currency, availability, GTIN/MPN, brand, ratings), return policy and shipping details, policy pages, product sitemap/feed, platform and Stripe detection, and agent protocol discovery files (/.well-known/ucp, /.well-known/acp.json, MCP server card). Returns a 0-100 score, readiness level and a prioritized fix list.

  Parameters:

  • url (required) — string — Store domain or a product page URL, e.g. "allbirds.com" or "https://shop.example.com/products/blue-mug".

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world yes

• company_profile read-only

  Company profile from a domain: a one-line summary, what the company does, founded, headquarters, industry, employee count, founders, parent company, public listing (ticker, exchange, SEC business address and industry), key pages (pricing, docs, contact, careers, status), social profiles, current prices with the date seen, tech stack, role contact emails, domain age and mail provider, and AI-readiness. From the company's own website plus Wikidata, SEC EDGAR, RDAP and DNS.

  Parameters:

  • domain (required) — string — Company domain or homepage URL, e.g. "stripe.com".

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world yes

• check_before_paying read-only

  Should your agent pay this? Run before paying an x402 / pay-per-call endpoint, an unfamiliar seller or a wallet address. Returns a verdict (ok_to_pay, caution, dont_pay, no_payment_needed) with reasons, from: the endpoint's live payment terms (price, token, payment address), its listing in Coinbase's x402 marketplace (how many different wallets paid it in 30 days, listed payment address), whether the live payment address matches the listing, whether the token is real USDC, the price compared with typical prices for similar tools, and the seller domain's age, website and mail security. Read-only: never pays or signs anything.

  Parameters:

  • target (required) — string — Paid endpoint URL (e.g. "https://api.example.com/v1/search"), seller domain (e.g. "example.com") or wallet address (0x...).
  • amount_usd — number — Optional: the amount in USD you are about to pay, to check it against what the endpoint asks for.

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world yes

• package_check read-only

  Before installing an npm or PyPI package: does it exist (AI-suggested names are sometimes made up, and attackers register them), has it been reported as malicious, which known vulnerabilities affect this version (with the fixed version), is it deprecated or yanked, how old is it, does it run code on install, how many downloads, and does its name imitate a popular package (typosquat). Verdict: ok_to_install, caution, dont_install or does_not_exist, with reasons. From OSV.dev, deps.dev, the npm registry and PyPI.

  Parameters:

  • name (required) — string — Package name, optionally with a version: "lodash", "[email protected]", "@scope/pkg", "requests==2.31.0".
  • version — string — Optional version to check (default: latest).
  • ecosystem — string — npm (default) or pypi.

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world yes

• why_is_it_moving read-only

  For a US stock ticker: the likely catalysts behind a move, from primary sources, in seconds. Ranks the last 48 hours (adjustable) of SEC filings: 8-K events decoded into plain English (deals, earnings, new debt, unregistered share sales, delisting notices, management changes), the press-release headline from Exhibit 99.1, offerings and shelf registrations (dilution), insider open-market buys and sells from Form 4 (who, shares, price, value), 5%+ stakes (13D/13G); plus whether the stock is halted or was halted today and why. Each item has its time, a link to the filing and why it ranks where it does; filing bursts say which filing to read first. An explicit answer status (filing_found, news_halt_no_filing_yet, unexplained_by_primary_sources) and a coverage block (window searched, when each source was last checked, latest filing date) let an agent tell "nothing filed" apart from "a source failed". Facts only: no price data and no buy/sell opinions.

  Parameters:

  • ticker (required) — string — US stock ticker, e.g. "AAPL" or "BRK.B".
  • hours — integer — How far back to look, in hours (default 48).

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world yes

• trading_halts read-only

  US stock trading halts right now and earlier today (Nasdaq, NYSE, NYSE American and other US markets), from Nasdaq's halt feed refreshed every minute. For each: symbol, market, the reason in plain English (news pending, volatility pause, additional information requested, regulatory concern...), halt time, and when quoting and trading resume, with a status (halted, resuming_soon, resumed). Filter by one or more tickers, or omit for all.

  Parameters:

  • symbols — string — Optional: one or more tickers separated by commas, e.g. "FFAI, AAPL". Omit for all current halts.

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world yes

• x402_market_report read-only

  What paid AI-agent tools cost and who sells the most, from an hourly index of Coinbase's x402 marketplace (about 38,000 pay-per-call endpoints). For a category or a search phrase: the typical price that paying wallets actually accept (median, middle range, top 10%), a price distribution, the top sellers by distinct paying wallets in the last 30 days, new listings this week that are already being paid, and how concentrated the market is. Use it to price your own x402 endpoint, or to pick which paid tool to call.

  Parameters:

  • limit — integer — How many top sellers and new listings to return (default 10).
  • query — string — Optional search phrase matched against listing names, descriptions and URLs, e.g. "transcription" or "weather".
  • category — string — Optional category, e.g. "scraping", "web_search", "llm", "market_data", "onchain". Omit for the whole marketplace plus a per-category table.

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world no

• find_best_api read-only

  Describe what you need ("web search", "weather forecast", "verify an email", "pdf to text", "people enrichment") and get the top 1-5 pay-per-call (x402) APIs to use, from an hourly index of Coinbase's x402 marketplace (~38,000 endpoints). Ranked by evidence that other agents keep paying for them: calls per paying wallet over 30 days (so one-off sampling bots count little), how recently each was paid, relevance and price vs. typical. Top candidates are checked live (still asking for payment, at the listed price). Each result: endpoint URL, method, price, network, why it ranks there, and flags (mostly one-time payers, above typical price, not called recently, did not answer). Read-only; never pays.

  Parameters:

  • task (required) — string — What you need the API for, in a few words, e.g. "web search", "transcribe audio", "company enrichment".
  • limit — integer — How many APIs to return (default 3).
  • check_live — boolean — Check the top candidates live (default true). False is faster.
  • max_price_usd — number — Optional price cap per call in USD, e.g. 0.05.

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world yes

• brainstorm_ideas read-only

  Brainstorm ideas for a topic, goal, problem or question, each scored 1-10 on three criteria that fit the kind of brainstorm (for business ideas: market size, ease to start, profit potential; for problem solving: impact, feasibility, cost to implement) with an overall score, sorted best first. depth 2 also grows 3 sub-ideas under each of the top 3. Returns a map_url that opens the result as an interactive bubble map on stormap.ai, where a person can keep growing, re-scoring and sharing it. Scores are quick model estimates for sorting, not research.

  Parameters:

  • topic (required) — string — What to brainstorm, e.g. "side hustles for engineers", "reduce factory scrap rate", "YouTube channel about home cooking".
  • mode — string — Kind of brainstorm; sets the scoring criteria (default general). breakdown splits the topic into exhaustive, non-overlapping parts with no scores.
  • count — integer — Ideas at the top level (default 5).
  • depth — integer — 1 (default) or 2 to also grow sub-ideas under the top 3.
  • steer — string — Optional constraint, e.g. "cheap, no hardware", "for beginners".

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world yes

• email_domain_check read-only

  Is this email address or domain real and legitimate? For lead research, signup / fraud screening, outreach list cleaning and vendor checks. Returns a verdict (looks_legitimate, risky, invalid) with reasons, plus: email syntax, role address (sales@, info@), free provider or disposable/throwaway service, whether the domain accepts mail (MX, null MX), mail provider (Google Workspace, Microsoft 365...), SPF and DMARC policy, whether the website loads, and domain age from RDAP. Does not contact the mail server, so it cannot confirm a specific mailbox exists.

  Parameters:

  • email (required) — string — Email address (e.g. "[email protected]") or a bare domain (e.g. "stripe.com").

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world yes

• read_url read-only

  Read a web page for an AI: fetch a public page and return its main content as clean, LLM-ready Markdown (navigation, footers, scripts and cookie banners removed) plus metadata: title, description, author, published/modified dates, canonical URL, language and word count. Reads server-rendered HTML (no JavaScript execution) and respects robots.txt.

  Parameters:

  • url (required) — string — Public page URL, e.g. "https://example.com/blog/post".
  • max_chars — integer — Maximum Markdown length to return.

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world yes

• search_guides read-only

  Search Stormap's practical guides on building with AI agents (OpenClaw, Hermes, Claude, coding agents, browser automation, RAG, MCP, AI news). Returns titles, URLs, Markdown URLs and short descriptions.

  Parameters:

  • query (required) — string — What to look for, e.g. "install hermes desktop" or "stop coding agents overwriting files".
  • limit — integer
  • category — string — Optional category filter, e.g. "OpenClaw Tutorials", "AI News", "AI Tools", "Automation".

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world no

• get_guide read-only

  Return one Stormap guide as clean Markdown with front matter (title, URL, dates, tags). Accepts a slug ("how-to-install-hermes-desktop") or a stormap.ai post URL.

  Parameters:

  • slug (required) — string — Guide slug or full https://stormap.ai/post/... URL.
  • max_chars — integer

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world no

• ai_visibility_score read-only

  AI search / GEO / AEO audit: score how well AI assistants (ChatGPT, Claude, Perplexity, Gemini) can find, read and cite a public web page: 0-100 score, letter grade, pass/fail checks (AI answer-bot access in robots.txt, server-rendered content, title/meta, JSON-LD, canonical, llms.txt, sitemap) and a prioritized fix list. Blocking bulk training crawlers is treated as a policy choice and does not lower the score.

  Parameters:

  • url (required) — string — Public page URL or domain, e.g. "example.com" or "https://example.com/pricing".

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world yes

• check_ai_crawler_access read-only

  Check whether AI crawlers (GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, Claude-User, PerplexityBot, Google-Extended, CCBot) may access a public URL according to its robots.txt, and score the page's machine readability (status, title, meta description, canonical, JSON-LD, server-rendered text). Returns a 0-100 score and a list of findings.

  Parameters:

  • url (required) — string — Public page URL or domain, e.g. "https://example.com/pricing".

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world yes

• generate_llms_txt read-only

  Generate an llms.txt file (llmstxt.org format) for a public website. Uses the site name, summary and pages you pass; anything missing is filled from the homepage and sitemap.xml. Returns the file text plus notes on how to improve it.

  Parameters:

  • site_url (required) — string — Site root, e.g. "https://example.com".
  • pages — array — Optional list of the most important page URLs. If omitted, sitemap.xml is used.
  • summary — string — One paragraph: what the site is, who it is for, what is most useful.
  • max_pages — integer
  • site_name — string

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world yes

• generate_ai_robots_txt read-only

  Generate robots.txt rules for AI crawlers from a policy: "open" (allow all), "balanced" (allow search and user-triggered fetchers, block bulk training crawlers) or "block" (block all). Optional per-bot overrides, allowed/blocked paths, sitemap and crawl delay. No network access.

  Parameters:

  • policy — string
  • site_url — string
  • overrides — object — e.g. {"GPTBot":"allow","CCBot":"block"}
  • allow_paths — array
  • crawl_delay — integer
  • sitemap_url — string
  • disallow_paths — array

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world no

Publisher website

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.