Stormap

Vendor security review / third-party risk check: a first-pass security and privacy profile of a software vendor from its own public website, given a domain. Answers "is this vendor SOC 2 certified?" and "do they train AI on our data?": certifications it claims (SOC 2 Type I/II, ISO 27001/27701/42001, HIPAA, PCI DSS, FedRAMP…), whether it trains AI models on customer data (with the exact quote and page), subprocessor list, DPA, data residency, security features (SSO/SAML, SCIM, MFA, encryption, pen tests, bug bounty), security.txt contact, status page, links to trust center, privacy policy and terms, plus a 0-100 transparency score. Use for vendor risk assessments, procurement and security questionnaires. Certifications are vendor claims, not verified audits.

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "description": "Vendor domain, e.g. \"notion.com\"."
    }
  },
  "required": [
    "domain"
  ],
  "additionalProperties": false
}

Did they raise prices or change their terms? What changed on a company's pricing, terms of service, privacy policy and subprocessor pages, and when. Returns the change history (prices added/removed, free plan or trial added/removed, subprocessors added/removed, text added/removed) and the current prices. Stormap checks tracked pages about once a day; asking about a new company starts tracking it, so history builds from that day. Useful for competitor monitoring, vendor renewals and compliance.

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "description": "Company domain, e.g. \"linear.app\"."
    },
    "since_days": {
      "type": "integer",
      "minimum": 1,
      "maximum": 3650,
      "default": 365,
      "description": "Only return changes from the last N days."
    }
  },
  "required": [
    "domain"
  ],
  "additionalProperties": false
}

Is this store ready for ChatGPT shopping? Audit whether an online store is ready for AI shopping agents (ChatGPT shopping and Instant Checkout via ACP, Google AI Mode via UCP, Perplexity, Claude): AI bot access to product pages, Product structured data (price, currency, availability, GTIN/MPN, brand, ratings), return policy and shipping details, policy pages, product sitemap/feed, platform and Stripe detection, and agent protocol discovery files (/.well-known/ucp, /.well-known/acp.json, MCP server card). Returns a 0-100 score, readiness level and a prioritized fix list.

{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "Store domain or a product page URL, e.g. \"allbirds.com\" or \"https://shop.example.com/products/blue-mug\"."
    }
  },
  "required": [
    "url"
  ],
  "additionalProperties": false
}

Company profile from a domain: a one-line summary, what the company does, founded, headquarters, industry, employee count, founders, parent company, public listing (ticker, exchange, SEC business address and industry), key pages (pricing, docs, contact, careers, status), social profiles, current prices with the date seen, tech stack, role contact emails, domain age and mail provider, and AI-readiness. From the company's own website plus Wikidata, SEC EDGAR, RDAP and DNS.

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "description": "Company domain or homepage URL, e.g. \"stripe.com\"."
    }
  },
  "required": [
    "domain"
  ],
  "additionalProperties": false
}

Should your agent pay this? Run before paying an x402 / pay-per-call endpoint, an unfamiliar seller or a wallet address. Returns a verdict (ok_to_pay, caution, dont_pay, no_payment_needed) with reasons, from: the endpoint's live payment terms (price, token, payment address), its listing in Coinbase's x402 marketplace (how many different wallets paid it in 30 days, listed payment address), whether the live payment address matches the listing, whether the token is real USDC, the price compared with typical prices for similar tools, and the seller domain's age, website and mail security. Read-only: never pays or signs anything.

{
  "type": "object",
  "properties": {
    "target": {
      "type": "string",
      "description": "Paid endpoint URL (e.g. \"https://api.example.com/v1/search\"), seller domain (e.g. \"example.com\") or wallet address (0x...)."
    },
    "amount_usd": {
      "type": "number",
      "description": "Optional: the amount in USD you are about to pay, to check it against what the endpoint asks for."
    }
  },
  "required": [
    "target"
  ],
  "additionalProperties": false
}

Before installing an npm or PyPI package: does it exist (AI-suggested names are sometimes made up, and attackers register them), has it been reported as malicious, which known vulnerabilities affect this version (with the fixed version), is it deprecated or yanked, how old is it, does it run code on install, how many downloads, and does its name imitate a popular package (typosquat). Verdict: ok_to_install, caution, dont_install or does_not_exist, with reasons. From OSV.dev, deps.dev, the npm registry and PyPI.

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "Package name, optionally with a version: \"lodash\", \"[email protected]\", \"@scope/pkg\", \"requests==2.31.0\"."
    },
    "ecosystem": {
      "type": "string",
      "enum": [
        "npm",
        "pypi"
      ],
      "description": "npm (default) or pypi."
    },
    "version": {
      "type": "string",
      "description": "Optional version to check (default: latest)."
    }
  },
  "required": [
    "name"
  ],
  "additionalProperties": false
}

For a US stock ticker: the likely catalysts behind a move, from primary sources, in seconds. Ranks the last 48 hours (adjustable) of SEC filings: 8-K events decoded into plain English (deals, earnings, new debt, unregistered share sales, delisting notices, management changes), the press-release headline from Exhibit 99.1, offerings and shelf registrations (dilution), insider open-market buys and sells from Form 4 (who, shares, price, value), 5%+ stakes (13D/13G); plus whether the stock is halted or was halted today and why. Each item has its time, a link to the filing and why it ranks where it does; filing bursts say which filing to read first. An explicit answer status (filing_found, news_halt_no_filing_yet, unexplained_by_primary_sources) and a coverage block (window searched, when each source was last checked, latest filing date) let an agent tell "nothing filed" apart from "a source failed". Facts only: no price data and no buy/sell opinions.

{
  "type": "object",
  "properties": {
    "ticker": {
      "type": "string",
      "description": "US stock ticker, e.g. \"AAPL\" or \"BRK.B\"."
    },
    "hours": {
      "type": "integer",
      "minimum": 1,
      "maximum": 168,
      "description": "How far back to look, in hours (default 48)."
    }
  },
  "required": [
    "ticker"
  ],
  "additionalProperties": false
}

US stock trading halts right now and earlier today (Nasdaq, NYSE, NYSE American and other US markets), from Nasdaq's halt feed refreshed every minute. For each: symbol, market, the reason in plain English (news pending, volatility pause, additional information requested, regulatory concern...), halt time, and when quoting and trading resume, with a status (halted, resuming_soon, resumed). Filter by one or more tickers, or omit for all.

{
  "type": "object",
  "properties": {
    "symbols": {
      "type": "string",
      "description": "Optional: one or more tickers separated by commas, e.g. \"FFAI, AAPL\". Omit for all current halts."
    }
  },
  "additionalProperties": false
}

What paid AI-agent tools cost and who sells the most, from an hourly index of Coinbase's x402 marketplace (about 32,000 pay-per-call endpoints). For a category or a search phrase: the typical price that paying wallets actually accept (median, middle range, top 10%), a price distribution, the top sellers by distinct paying wallets in the last 30 days, new listings this week that are already being paid, and how concentrated the market is. Use it to price your own x402 endpoint, or to pick which paid tool to call.

{
  "type": "object",
  "properties": {
    "category": {
      "type": "string",
      "enum": [
        "web_search",
        "email",
        "enrichment",
        "scraping",
        "llm",
        "image",
        "audio",
        "documents",
        "news",
        "weather",
        "market_data",
        "onchain",
        "domain_security",
        "other"
      ],
      "description": "Optional category, e.g. \"scraping\", \"web_search\", \"llm\", \"market_data\", \"onchain\". Omit for the whole marketplace plus a per-category table."
    },
    "query": {
      "type": "string",
      "description": "Optional search phrase matched against listing names, descriptions and URLs, e.g. \"transcription\" or \"weather\"."
    },
    "limit": {
      "type": "integer",
      "minimum": 1,
      "maximum": 25,
      "description": "How many top sellers and new listings to return (default 10)."
    }
  },
  "additionalProperties": false
}

Describe what you need ("web search", "weather forecast", "verify an email", "pdf to text", "people enrichment") and get the top 1-5 pay-per-call (x402) APIs to use, from an hourly index of Coinbase's x402 marketplace (~38,000 endpoints). Ranked by evidence that other agents keep paying for them: calls per paying wallet over 30 days (so one-off sampling bots count little), how recently each was paid, relevance and price vs. typical. Top candidates are checked live (still asking for payment, at the listed price). Each result: endpoint URL, method, price, network, why it ranks there, and flags (mostly one-time payers, above typical price, not called recently, did not answer). Read-only; never pays.

{
  "type": "object",
  "properties": {
    "task": {
      "type": "string",
      "description": "What you need the API for, in a few words, e.g. \"web search\", \"transcribe audio\", \"company enrichment\"."
    },
    "max_price_usd": {
      "type": "number",
      "description": "Optional price cap per call in USD, e.g. 0.05."
    },
    "limit": {
      "type": "integer",
      "minimum": 1,
      "maximum": 5,
      "description": "How many APIs to return (default 3)."
    },
    "check_live": {
      "type": "boolean",
      "description": "Check the top candidates live (default true). False is faster."
    }
  },
  "required": [
    "task"
  ],
  "additionalProperties": false
}

Is this email address or domain real and legitimate? For lead research, signup / fraud screening, outreach list cleaning and vendor checks. Returns a verdict (looks_legitimate, risky, invalid) with reasons, plus: email syntax, role address (sales@, info@), free provider or disposable/throwaway service, whether the domain accepts mail (MX, null MX), mail provider (Google Workspace, Microsoft 365...), SPF and DMARC policy, whether the website loads, and domain age from RDAP. Does not contact the mail server, so it cannot confirm a specific mailbox exists.

{
  "type": "object",
  "properties": {
    "email": {
      "type": "string",
      "description": "Email address (e.g. \"[email protected]\") or a bare domain (e.g. \"stripe.com\")."
    }
  },
  "required": [
    "email"
  ],
  "additionalProperties": false
}

Read a web page for an AI: fetch a public page and return its main content as clean, LLM-ready Markdown (navigation, footers, scripts and cookie banners removed) plus metadata: title, description, author, published/modified dates, canonical URL, language and word count. Reads server-rendered HTML (no JavaScript execution) and respects robots.txt.

{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "Public page URL, e.g. \"https://example.com/blog/post\"."
    },
    "max_chars": {
      "type": "integer",
      "minimum": 500,
      "maximum": 100000,
      "default": 20000,
      "description": "Maximum Markdown length to return."
    }
  },
  "required": [
    "url"
  ],
  "additionalProperties": false
}

Search Stormap's practical guides on building with AI agents (OpenClaw, Hermes, Claude, coding agents, browser automation, RAG, MCP, AI news). Returns titles, URLs, Markdown URLs and short descriptions. Use get_guide to read one.

{
  "type": "object",
  "properties": {
    "query": {
      "type": "string",
      "description": "What to look for, e.g. \"install hermes desktop\" or \"stop coding agents overwriting files\"."
    },
    "category": {
      "type": "string",
      "description": "Optional category filter, e.g. \"OpenClaw Tutorials\", \"AI News\", \"AI Tools\", \"Automation\"."
    },
    "limit": {
      "type": "integer",
      "minimum": 1,
      "maximum": 20,
      "default": 5
    }
  },
  "required": [
    "query"
  ],
  "additionalProperties": false
}

Return one Stormap guide as clean Markdown with front matter (title, URL, dates, tags). Accepts a slug ("how-to-install-hermes-desktop") or a stormap.ai post URL.

{
  "type": "object",
  "properties": {
    "slug": {
      "type": "string",
      "description": "Guide slug or full https://stormap.ai/post/... URL."
    },
    "max_chars": {
      "type": "integer",
      "minimum": 1000,
      "maximum": 200000,
      "default": 60000
    }
  },
  "required": [
    "slug"
  ],
  "additionalProperties": false
}

AI search / GEO / AEO audit: score how well AI assistants (ChatGPT, Claude, Perplexity, Gemini) can find, read and cite a public web page: 0-100 score, letter grade, pass/fail checks (AI answer-bot access in robots.txt, server-rendered content, title/meta, JSON-LD, canonical, llms.txt, sitemap) and a prioritized fix list. Blocking bulk training crawlers is treated as a policy choice and does not lower the score.

{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "Public page URL or domain, e.g. \"example.com\" or \"https://example.com/pricing\"."
    }
  },
  "required": [
    "url"
  ],
  "additionalProperties": false
}

Check whether AI crawlers (GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, Claude-User, PerplexityBot, Google-Extended, CCBot) may access a public URL according to its robots.txt, and score the page's machine readability (status, title, meta description, canonical, JSON-LD, server-rendered text). Returns a 0-100 score and a list of findings.

{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "Public page URL or domain, e.g. \"https://example.com/pricing\"."
    }
  },
  "required": [
    "url"
  ],
  "additionalProperties": false
}

Generate an llms.txt file (llmstxt.org format) for a public website. Uses the site name, summary and pages you pass; anything missing is filled from the homepage and sitemap.xml. Returns the file text plus notes on how to improve it.

{
  "type": "object",
  "properties": {
    "site_url": {
      "type": "string",
      "description": "Site root, e.g. \"https://example.com\"."
    },
    "site_name": {
      "type": "string"
    },
    "summary": {
      "type": "string",
      "description": "One paragraph: what the site is, who it is for, what is most useful."
    },
    "pages": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "maxItems": 100,
      "description": "Optional list of the most important page URLs. If omitted, sitemap.xml is used."
    },
    "max_pages": {
      "type": "integer",
      "minimum": 5,
      "maximum": 60,
      "default": 25
    }
  },
  "required": [
    "site_url"
  ],
  "additionalProperties": false
}

Generate robots.txt rules for AI crawlers from a policy: "open" (allow all), "balanced" (allow search and user-triggered fetchers, block bulk training crawlers) or "block" (block all). Optional per-bot overrides, allowed/blocked paths, sitemap and crawl delay. No network access.

{
  "type": "object",
  "properties": {
    "policy": {
      "type": "string",
      "enum": [
        "open",
        "balanced",
        "block"
      ],
      "default": "balanced"
    },
    "overrides": {
      "type": "object",
      "additionalProperties": {
        "type": "string",
        "enum": [
          "allow",
          "block"
        ]
      },
      "description": "e.g. {\"GPTBot\":\"allow\",\"CCBot\":\"block\"}"
    },
    "allow_paths": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "disallow_paths": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "sitemap_url": {
      "type": "string"
    },
    "crawl_delay": {
      "type": "integer",
      "minimum": 1,
      "maximum": 60
    },
    "site_url": {
      "type": "string"
    }
  },
  "additionalProperties": false
}