8 free MCP tools for AI agents, no API key: web to Markdown, CVEs, domains, papers

#python #api #mcp #ai

Most MCP servers you find in directories want an API key, a local install, or both. I wanted the opposite for a few boring-but-useful lookups my agents do all day: read a web page as Markdown, check a domain, look up CVEs for a package version, search papers. So I put 8 of them behind one remote MCP URL that works without a key.

https://2-29-135-242.sslip.io/mcp

It is a streamable-HTTP MCP server, stateless JSON, read-only tools. Each IP gets 25 free calls per UTC day. Above that, every tool is also available as a pay-per-call x402 endpoint (USDC), charged only when it returns results.

The 8 tools

Tool	Source	Typical use
`web_read`	the page itself	URL to clean Markdown for RAG or summaries
`domain_intel`	RDAP + DNS + TLS	registrar, expiry, nameservers, MX, SPF/DMARC, cert expiry
`email_auth`	DNS	SPF / DKIM / DMARC / MX check before cold email or vendor review
`osv_vulns`	OSV.dev + CISA KEV + EPSS	known vulns for `package@version`, fixed versions, exploit odds
`literature_search`	OpenAlex + Crossref	papers, DOIs, citations, open-access links
`federal_register`	federalregister.gov	US final/proposed rules and notices
`clinical_trials`	ClinicalTrials.gov v2	trials by condition, drug, sponsor, status
`prediction_markets`	Polymarket + Kalshi	live odds for an event in one call

All sources are official or open APIs. No logins and no scraping behind walls.

Connect it

Claude Code

claude mcp add --transport http radar-tools https://2-29-135-242.sslip.io/mcp

Claude Desktop / Cursor / Windsurf (mcpServers JSON)

{
  "mcpServers": {
    "radar-tools": { "url": "https://2-29-135-242.sslip.io/mcp" }
  }
}

It is also in the official MCP Registry as io.sslip.2-29-135-242/radar-agent-tools, so registry-aware clients can find it by name.

Raw call with curl

MCP is just JSON-RPC over HTTP, so you can test it without any client:

curl -s https://2-29-135-242.sslip.io/mcp \
  -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call",
       "params":{"name":"osv_vulns",
                 "arguments":{"package":"requests","ecosystem":"PyPI","version":"2.25.0"}}}'

Real output (trimmed), run on 2026-11-06:

{"count": 8, "items": [{
  "id": "GHSA-j8r2-6x86-q33q",
  "cves": ["CVE-2023-32681"],
  "summary": "Unintended leak of Proxy-Authorization header in requests",
  "severity": "MODERATE",
  "fixedVersions": ["2.31.0"],
  "knownExploited": false,
  "epss": 0.02974,
  "upgradeToFixAll": "2.33.0",
  "upgradeVerified": true
}, ...]}

The part I use most is upgradeToFixAll: one version that fixes every listed advisory, re-checked on OSV so the suggested version itself has no known advisories. So an agent can open a single upgrade PR instead of reasoning about 8 advisories.

domain_intel on dev.to returns RDAP + DNS in one call (trimmed):

{"domain": "dev.to",
 "rdap": {"registrar": "Tonic", "created": "2016-04-05T02:27:16.000Z",
          "expires": "2027-04-05T02:27:16.000Z",
          "nameservers": ["jill.ns.cloudflare.com", "josh.ns.cloudflare.com"]},
 "dns": {"MX": ["1 smtp.google.com."],
         "DMARC": ["v=DMARC1; p=reject; sp=reject; pct=100; ..."]}}

Prompts that work well

"Check requests==2.25.0 and urllib3==1.26.4 for known vulnerabilities and tell me the smallest safe upgrade."
"Read https://example.com/pricing and summarise the plans as a table."
"When does the domain of this vendor expire, and is their email protected by DMARC?"
"Find 5 recent papers on retrieval-augmented generation evaluation with DOIs."
"What are the current odds on Polymarket and Kalshi for the next Fed rate decision?"

Limits, honestly

25 free calls per IP per day, 1,500 free calls per day in total (it is one small server).
Read-only. No browser rendering for heavy JavaScript apps in web_read; it fetches the HTML and extracts the main content.
Paid use is x402 (USDC on Base) at https://2-29-135-242.sslip.io/x402/<tool>. If you would rather pay per result with a normal account, the bigger versions run as Apify Actors under martin10291.

If a tool is missing a field you need, leave a comment with the call you made and what you expected. I read them.

DEV Community