MCP Services

Multi-tool MCP server + REST API for AI agents. 29 tools across web scraping, SEO analysis, agent memory, screenshot/PDF generation, domain intelligence, content extraction, multi-chain EVM blockchain queries, and security toolkit.

Live: mcp.skills.ws | Docs: llms.txt | npm: npm install -g mcp-services

Quick Start

Use the hosted version (no setup)

Add to your MCP client config (Claude Desktop, Cursor, OpenClaw, etc.):

{
  "mcpServers": {
    "mcp-services": {
      "url": "https://mcp.skills.ws/mcp/sse"
    }
  }
}

Free tier: 10 calls/day, no auth needed.

Self-host

npm install -g mcp-services
mcp-services
# -> running on http://localhost:3100

Tools (29)

Web Scraping

SEO Toolkit

Agent Memory

Screenshot & PDF

Content Extraction

Domain Intelligence

Blockchain (6 EVM chains)

Supported chains: Ethereum, Base, Arbitrum, Optimism, Polygon, Celo

Security Toolkit

Security tools degrade gracefully without API keys (heuristics-only mode). Optional keys: VT_API_KEY, ABUSEIPDB_API_KEY, ETHERSCAN_API_KEY.

Authentication

Three tiers -- use whichever fits:

API Key

Subscribe via Stripe to get an unlimited API key:

For migration only, query-string API keys (?apikey=) can be temporarily re-enabled with ALLOW_APIKEY_QUERY=true. This mode is deprecated; prefer X-Api-Key.

# 1. Create checkout session
curl -X POST https://mcp.skills.ws/billing/checkout
# Returns: { "url": "https://checkout.stripe.com/..." }

# 2. Complete payment at the Stripe URL
# 3. You'll receive your API key on the success page (shown once only -- save it)

# 4. Use it
curl -H "X-Api-Key: mcp_your_key" "https://mcp.skills.ws/api/whois?domain=example.com"

x402 Pay-per-call

No account needed. Pay with USDC or USDT on Base or Celo. x402-compatible agents handle payment automatically.

curl -H "X-Payment: <base64-encoded-json>" "https://mcp.skills.ws/api/screenshot?url=https://example.com"

REST API

All tools are also available as REST endpoints:

# Web Scraping
curl "https://mcp.skills.ws/api/scrape?url=https://example.com"
curl "https://mcp.skills.ws/api/crawl?url=https://example.com&depth=2&maxPages=10"
curl "https://mcp.skills.ws/api/extract?url=https://example.com"

# SEO
curl "https://mcp.skills.ws/api/serp?keyword=mcp+server"
curl "https://mcp.skills.ws/api/onpage-seo?url=https://example.com"
curl "https://mcp.skills.ws/api/keywords?keyword=ai+agents"

# Memory
curl -X POST "https://mcp.skills.ws/api/memory" \
  -H "Content-Type: application/json" \
  -d '{"namespace":"my-agent","key":"greeting","value":"Hello world","tags":["demo"]}'
curl "https://mcp.skills.ws/api/memory?namespace=my-agent&key=greeting"
curl "https://mcp.skills.ws/api/memory/search?namespace=my-agent&query=hello"

# Domain Intelligence
curl "https://mcp.skills.ws/api/whois?domain=example.com"
curl "https://mcp.skills.ws/api/dns?domain=example.com&type=ALL"
curl "https://mcp.skills.ws/api/ssl?domain=example.com"

# Content
curl "https://mcp.skills.ws/api/screenshot?url=https://example.com&format=png"
curl "https://mcp.skills.ws/api/pdf?url=https://example.com"
curl "https://mcp.skills.ws/api/pdf2docx?url=https://example.com/document.pdf"

# Blockchain
curl "https://mcp.skills.ws/api/chain/balance?address=0x...&chain=ethereum"
curl "https://mcp.skills.ws/api/chain/erc20?address=0x...&token=0x...&chain=celo"

# Security
curl "https://mcp.skills.ws/api/security/url-scan?url=https://suspicious-site.com"
curl "https://mcp.skills.ws/api/security/wallet-check?address=0x...&chain=ethereum"
curl "https://mcp.skills.ws/api/security/contract-scan?address=0x...&chainId=1"
curl "https://mcp.skills.ws/api/security/email-headers?domain=example.com"
curl "https://mcp.skills.ws/api/security/threat-intel?ioc=8.8.8.8&type=ip"
curl "https://mcp.skills.ws/api/security/header-audit?url=https://example.com"
curl "https://mcp.skills.ws/api/security/vuln-headers?url=https://example.com"

Environment Variables

Reverse proxy & client IP configuration

mcp-services defaults to TRUST_PROXY=false, which means the app ignores X-Forwarded-For and uses the direct socket peer IP for rate limits and free-tier memory namespacing.

Enable TRUST_PROXY only when your deployment is actually behind a trusted reverse proxy/load balancer that rewrites forwarding headers. Common options:

• TRUST_PROXY=1 when exactly one trusted proxy sits in front of Node.js
• TRUST_PROXY=loopback for local proxy setups
• TRUST_PROXY=<cidr> (or comma-separated values) for explicit trusted proxy ranges

When trust proxy is enabled, Express derives req.ip from X-Forwarded-For according to that trust policy. Ensure your edge proxy:

1. Appends/sets a valid X-Forwarded-For chain
2. Prevents direct untrusted clients from spoofing forwarding headers
3. Forwards the real client address as the left-most IP in X-Forwarded-For

If X-Forwarded-For is present while TRUST_PROXY=false, the server logs a defensive warning and ignores that header.

For production, set SSE_ALLOWED_HOSTS and SSE_ALLOWED_ORIGINS to strict, explicit values (only your public MCP domain and trusted app origins). Avoid wildcards or broad internal host lists.

Deployment hardening checklist (recommended)

• Set NODE_ENV=production
• Keep ALLOW_APIKEY_QUERY=false (header auth only)
• Configure TRUST_PROXY correctly for your network path (do not blindly set true)
• Set strict SSE_ALLOWED_HOSTS and SSE_ALLOWED_ORIGINS
• Use REDIS_URL for shared rate-limits in multi-instance deployments
• Rotate ADMIN_SECRET and Stripe keys periodically
• Keep X402_TEST_MODE=0 in production (enforced by server)
• Persist KEYS_FILE, MEMORY_DB_PATH, and X402_TX_CACHE_FILE on durable storage
• Run npm audit in CI and fail builds on high/critical vulnerabilities

Production env quickstart

cp .env.production.example .env
# then edit .env values for your domain, proxy topology, redis and secrets

Stripe webhook edge allowlist auto-sync (nginx)

# Generate CIDR allowlist include from Stripe source and reload nginx
scripts/sync-stripe-webhook-ips.sh \
  --out /etc/nginx/snippets/stripe-webhook-allowlist.conf \
  --reload "systemctl reload nginx"

See deploy/nginx/stripe-webhook.conf.example for the webhook location block.

Security

• SSRF protection: URL validation + DNS pre-resolution + private IP blocking + Puppeteer request interception
• Domain validation: regex allowlist prevents command injection
• Input sanitization: format validation per IOC type, address format checks, chain allowlists
• Memory namespace isolation per auth tier (API key hash, IP, or x402)
• Rate limiting on free tier
• Resource limits: max concurrent browsers, SSE sessions, PDF size cap, 5MB response body limit
• Response size limits on external API fetches

Architecture

                  +------------------------------------+
                  |          Express Server             |
                  |                                     |
                  |  +---------+    +--------------+    |
  MCP SSE ------->  | MCP SDK |    |  Auth Layer   |   |
                  |  |  (SSE)  |    | free/key/x402 |   |
                  |  +---------+    +--------------+    |
                  |                                     |
  REST API ------>  +--------------------------------+  |
                  |  |        29 Tool Handlers        |  |
                  |  | scrape | crawl | extract       |  |
                  |  | serp | onpage_seo | keywords   |  |
                  |  | memory (5) | screenshot | pdf  |  |
                  |  | html2md | ocr | whois | dns    |  |
                  |  | ssl | balance | erc20 | tx     |  |
                  |  | url_scan | wallet_check        |  |
                  |  | contract_scan | email_headers   |  |
                  |  | threat_intel | header_audit     |  |
                  |  | vuln_headers                    |  |
                  |  +--------------------------------+  |
                  |        |              |              |
                  |  +-----+----+  +-----+----------+   |
                  |  | Puppeteer|  | viem (6 RPCs)   |   |
                  |  | Chromium |  | whois-json      |   |
                  |  |          |  | dns/promises    |   |
                  |  |          |  | security.js     |   |
                  |  +----------+  +-----------------+   |
                  |                                     |
  Stripe -------->  +--------------------------------+  |
  Webhooks        |  |   Billing (stripe.js)          |  |
                  |  |   checkout -> key provisioning  |  |
                  |  +--------------------------------+  |
                  +------------------------------------+

Stack

• Runtime: Node.js 22 + Express
• Browser: Puppeteer (Chromium) -- screenshots, PDF, OCR, html2md
• Blockchain: viem -- 6 EVM chains via public RPCs
• Security: VirusTotal, AbuseIPDB, Etherscan, Honeypot.is, OTX AlienVault + heuristics
• Payments: Stripe (subscriptions), x402 protocol (stablecoins on Base/Celo)
• MCP: @modelcontextprotocol/sdk with SSE transport
• Hosting: Aleph Cloud (decentralized compute)

License

MIT -- Commit Media SARL